CVE-2026-101767

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15

Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Application Object Library. The issue involves an unauthenticated SQL injection within the EBS Thin Client Framework servlet at the '/OA HTML/AppsTCFServer' endpoint, which can be chained to achieve remote code execution. Exploitation occurs when unauthenticated POST requests to the mentioned endpoint instantiate the oracle.apps.jtf.gantt.server.GanttDataServer class, potentially allowing the attacker to execute SQL and OS commands, leading to a full takeover of the system.

Recommendations Update Oracle Application Object Library versions 12.2.3 through 12.2.15 to the version provided in the October CPU. Restrict access to the '/OA HTML/AppsTCFServer' endpoint to minimize the risk of exploitation.