(horizon3.ai) Critical Unauthenticated SQL Injection and Remote Code Execution Vulnerability in Oracle E-Business Suite (CVE-2026-101767) In brief - This article describes CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite that can lead to remote code execution. Technically - This article details a vulnerability in the Thin Client Framework (TCF) servlet located at /OA_HTML/AppsTCFServer, specifically within the oracle.apps.fnd.tcf.SocketServer class. An unauthenticated attacker can send crafted HTTP/HTTPS requests to execute SQL commands as the APPS database user, which can be further chained to execute operating system commands via the EBS application account. The exploit involves instantiating the oracle.apps.jtf.gantt.server.GanttDataServer class and may result in the oracle account spawning /bin/sh via the Concurrent Manager. Source: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/ #Cybersecurity