Vulnerability · CVE-2026-101767

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).

Published Oct 20, 2026 · catalog updated Oct 27, 2026 · Oracle

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2026-101767 is in the CISA known-exploited catalog. Confirm Oracle against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.

Same product and reporting

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) · Press · Help Net Security
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch · Press · The Hacker News
Hackers Start Probing Fresh Oracle EBS Vulnerability · Press · SecurityWeek

Severity: Critical9.8
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 0.61%
Remediation: Remediation guidance
Affected products: vendor Oracle application_object_library

Serial Number: AV26-1071 Date: October 20, 2026 Updated: October 28, 2026 As of October 20, 2026, Oracle Corporation is affected by vulnerabilities in the following products: Helidon JD Edwards EnterpriseOne Configurator JD Edwards EnterpriseOne General Ledger JD Edwards EnterpriseOne Homebuilder JD Edwards EnterpriseOne Human Resources Management JD Edwards EnterpriseOne Localizations JD Edwards EnterpriseOne Operational Sourcing JD Edwards EnterpriseOne Orchestrator JD Edwards EnterpriseOne Sales Order Entry JD Edwards EnterpriseOne Tools MySQL Client MySQL Cluster MySQL Connectors MySQL Ent

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

vendor Oracle application_object_libraryversion unspecified

How to fix CVE-2026-101767

Vendor action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Version check
No version range is stored, so an installed version cannot be checked on this page.
Advisory
Open the canada record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-101767 is in the CISA known-exploited catalog. Confirm Oracle against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Affected version ranges are not on this record. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

CWE-287: Improper Authentication; CWE-306: Missing Authentication for Critical Function. EPSS 0.61%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 20, 2026 · NIST NVD
Detected
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Objec
Oct 21, 2026 · NIST NVD
Updated
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Objec
Oct 21, 2026 · NIST NVD
Updated
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Objec
Oct 27, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Oct 27, 2026 · VulnCheck KEV
Updated
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Objec

Sources

Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-101767
Serial Number: AV26-1071 Date: October 20, 2026 Updated: October 28, 2026 As of October 20, 2026, Oracle Corporation is affected by vulnerabilities in the following products: Helidon JD Edwards EnterpriseOne Configurator JD Edwards EnterpriseOne General Ledger JD Edwards Enterpri
cyber.gc.ca
CVE.orgVulnerability recordCVE-2026-101767
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-101767
30-day exploitation probability 0.61%
first.org
NIST NVDVulnerability recordCVE-2026-101767
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl
nvd.nist.gov
urlscan.ioThreat intelligenceCVE-2026-101767
urlscan.io
VulnCheck KEVConfirmed exploitationCVE-2026-101767
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle
vulncheck.com

References

Freshness

Last verified in this catalog Oct 30, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

urlscan.ioOct 31, 2026
Canadian Centre for Cyber SecurityOct 31, 2026
FIRST EPSSOct 30, 2026
VulnCheck KEVOct 30, 2026
NIST NVDOct 21, 2026
CVE.orgOct 21, 2026

Priority score

46/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability1/20
CVSS severity15/15
Public exploit0/10
Internet exposure0/10
Product prevalence0/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS probability
0.61% · p49.20%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Oct 27, 2026. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Stacks

Oracle

Weakness

CWE-287
Improper Authentication
MITRE definition
CWE-306
Missing Authentication for Critical Function
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.