The facts

  1. Oracle lists supported versions 12.2.3–12.2.15 as affected. A remote attacker with HTTP network access needs neither authentication nor user interaction; successful exploitation can compromise the Application Object Library. [1]

  2. Censys says the October Critical Patch Update is the complete remediation and points customers to Oracle’s installation-specific patch instructions. Network restrictions reduce exposure but do not repair the flaw. [3]

  3. Censys found 2,246 web properties running E-Business Suite. Its scan does not determine which run affected versions or have installed the patch, so this is not a count of vulnerable systems. [3]

Still unconfirmed

  • Successful exploitation of production systems and the number of unpatched deployments have not been established in the checked reports.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 02:05 UTC.

  1. October 2026 Critical Patch Update risk matrix

    Oracle · Primary source · 20 Oct 2026

    The exact CVE risk-matrix row was checked.

  2. Hackers start probing fresh Oracle EBS vulnerability

    SecurityWeek · Reporting · 28 Oct 2026

    Attributes the 27 October decoy observations to Defused; this is not confirmation of successful compromise of production systems.

  3. Oracle E-Business Suite advisory for CVE-2026-101767

    Censys · Primary source · 28 Oct 2026

    Original product-exposure measurements; technical analysis also draws on Oracle and finder Horizon3.ai. Its no-wild-exploitation entry is explicitly as of 27 October.

Report a factual error