Enterprise application suite flaw faces early exploit probes
The enterprise application suite (EBS), a collection of applications used to manage business operations and records, is facing early exploit probes aimed at CVE-2026-101767, a newly patched vulnerability that can lead to remote code execution, meaning an attacker can run commands on the affected application host. Threat intelligence firm Defused Cyber said its decoy systems recorded exploratory exploitation attempts on the morning of October 27, only days after the vendor addressed the flaw in its Critical Patch Update. The activity shows that attackers are already testing accessible systems, although the reported probes do not by themselves establish that any customer environment was successfully compromised.
The vulnerability affects the Application Object Library in the enterprise application suite (EBS), a collection of enterprise applications used to manage business processes. It has a Common Vulnerability Scoring System (CVSS) rating of 9.8, placing it in the critical range. The vendor describes the underlying weakness as improper authentication, in which a system does not correctly verify whether a request should be allowed. A Horizon3.ai research team discovered the flaw and reported it to the vendor on July 24, 2026.
Horizon3.ai identified the technical issue as an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet. SQL injection is a flaw that lets a crafted request interfere with commands sent to a database, while a servlet is a web application component that receives and processes requests. An attacker who can reach the vulnerable component at "/OA_HTML/AppsTCFServer" can submit a specially formed request without first signing in. That request can run database instructions with the privileges of the APPS database user, a powerful EBS account with access to application data.
The researchers found that the database access can be chained into operating system command execution. In that sequence, the attacker first runs SQL as the APPS user and then causes commands to run under the EBS application account on the host. Successful exploitation could therefore allow someone to read or change information available to APPS and execute commands on the application system. Horizon3.ai said the exposed records may include financial, payroll, human resources and procurement data, depending on how the organisation has deployed EBS. The operating system actions available to an attacker would be limited by the permissions assigned to the compromised application account.
Internet-facing EBS installations carry the clearest exposure because attackers can attempt to contact the vulnerable servlet directly. An internally hosted system is not automatically safe, however. Horizon3.ai warned that an internal deployment can still be reached from a previously compromised machine or another network segment that is permitted to connect to the servlet. For hosting and IT teams, the practical question is therefore not only whether EBS is publicly accessible, but which systems and networks can send requests to its web tier.
Enterprise application suite administrators are advised to install the latest available update as soon as possible. Where immediate patching is not possible, Horizon3.ai recommends removing "/OA_HTML/AppsTCFServer", associated with the SocketServer component, from the EBS URL firewall allowlist. An allowlist specifies which web addresses are permitted through a filtering control. Administrators can also restrict the EBS web tier to trusted networks and monitor both the application host and its database for evidence of exploitation. These measures reduce exposure but do not replace the security update.
Horizon3.ai also published several indicators of compromise, which are technical signs that may reveal attempted or successful misuse. Defenders should look for unauthenticated POST requests to "/OA_HTML/AppsTCFServer" that instantiate the Gantt data-server class, known as GanttDataServer, followed by database activity. Other warning signs include database reconnaissance soon after an unauthenticated web request, such as queries for the database version, current user or directory objects. Unexpected files in "$APPLPTMP" are another indicator, as is the application account launching "/bin/sh" through the Concurrent Manager to execute operating system commands.
The new probing follows active exploitation of two other critical EBS vulnerabilities during the past year. CVE-2025-61882 and CVE-2026-46817 both carry CVSS scores of 9.8. The Cl0p ransomware and extortion group used CVE-2025-61882, illustrating why newly disclosed EBS weaknesses require prompt attention from organisations holding sensitive operational records.
Businesses that need broader support around this work can consider AEU-I, which offers security-first IT, infrastructure and consulting. For affected organisations, the immediate priorities remain applying the vendor's update, reducing access to the vulnerable servlet and checking the listed indicators without assuming that an internal deployment is unreachable.