CVE-2026-101767

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15

Description An unauthenticated SQL injection exists in the Thin Client Framework (TCF) servlet of the Oracle Application Object Library. An attacker with network access via HTTP can exploit this issue to execute SQL commands as the APPS database user and subsequently escalate privileges to achieve remote code execution (RCE) with the permissions of the EBS application account on the host. This can lead to a complete takeover of the Oracle Application Object Library instance. The issue is exploitable via the '/OA HTML/AppsTCFServer' endpoint. Active scanning and exploratory exploitation attempts have been detected in the wild targeting this component.

Recommendations Apply the October 2026 Critical Patch Update (CPU) for Oracle Application Object Library versions 12.2.3 through 12.2.15. Restrict network access to the EBS application tier to minimize the risk of exploitation. Monitor for anomalous HTTP requests to Oracle Forms or OA Framework endpoints.