Attackers are actively probing Oracle E-Business Suite through a flaw rated 9.8 that needs no password at all, ITBriefcase reported in its weekly roundup on Oct. 30, 2026. The flaw, CVE-2026-101767, is an unauthenticated SQL injection that leads to remote code execution in versions 12.2.3 through 12.2.15.
The probing is not hypothetical. Defused Cyber honeypots logged exploitation attempts on Oct. 27, and Shadowserver tracked more than 670 exposed instances reachable from the internet. E-Business Suite runs ERP, human resources and purchasing for the companies that depend on it, so a single exposed instance puts core operations in reach.
A patch stops the next attempt. It does not evict the last one.
Researchers warn that patching does not remove webshells that earlier exploitation may have left behind. That changes the job from an update to a compromise assessment: check for persistence, review accounts and logs, and confirm the system is clean before declaring it fixed. Organizations that run these suites with enterprise systems integration and support should treat the ERP as a front-line system, not back-office furniture.
If Oracle E-Business Suite runs your finance, HR or purchasing, patch now, hunt for webshells and rogue accounts, and reduce internet exposure until the assessment is done. The flaw needs no password, so delay is the only credential an attacker requires.