# Hackers now scanning systems for recently-patched Oracle flaw

DevFeed: [Hackers now scanning systems for recently-patched Oracle flaw](<https://devfeed.tech/articles/hackers-now-scanning-systems-for-recently-patched-oracle-flaw-104468.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/>)

Author: Sergiu Gatlan

Published: 2026-10-28T12:19:57Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Internet](<https://devfeed.tech/topics/internet.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [actively-exploited](<https://devfeed.tech/tags/actively-exploited.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [cve-2026-101767](<https://devfeed.tech/tags/cve-2026-101767.md>), [defused](<https://devfeed.tech/tags/defused.md>), [e-business-suite](<https://devfeed.tech/tags/e-business-suite.md>), [ebs](<https://devfeed.tech/tags/ebs.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [exposed](<https://devfeed.tech/tags/exposed.md>), [hackers](<https://devfeed.tech/tags/hackers.md>), [healthcare](<https://devfeed.tech/tags/healthcare.md>), [http](<https://devfeed.tech/tags/http.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [intelligence](<https://devfeed.tech/tags/intelligence.md>), [internet](<https://devfeed.tech/tags/internet.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [oracle](<https://devfeed.tech/tags/oracle.md>), [oracle-e-business-suite](<https://devfeed.tech/tags/oracle-e-business-suite.md>), [patched](<https://devfeed.tech/tags/patched.md>), [scanning](<https://devfeed.tech/tags/scanning.md>), [security](<https://devfeed.tech/tags/security.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

Attackers were scanning the Internet for systems vulnerable to CVE-2026-101767, a critical Oracle E-Business Suite flaw. Oracle says the issue can enable unauthenticated takeover over HTTP and released patches on October 20, 2026, urging customers to apply them and use actively supported versions. Defused reported exploratory exploit activity against decoys on October 27, describing an SQL injection that chains to remote code execution. Shadowserver tracks more than 670 Internet-exposed EBS instances, but its count does not show how many are honeypots or already secured. Oracle had not tagged this flaw as exploited in the wild at the time of the excerpt.

## Source excerpt

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]