H3-2026-0062¶

Oracle E-Business Suite TCF SQL Injection and Remote Code Execution Vulnerability

Description¶

Oracle E-Business Suite's (EBS) Thin Client Framework servlet contains a chain of vulnerabilities that allows an unauthenticated attacker to inject arbitrary SQL as the APPS database user, and to escalate to remote code execution on the host.

Impact¶

An unauthenticated attacker with network access to the EBS web tier can read and modify any data in the APPS schema, and can execute arbitrary operating system commands as the E-Business Suite application OS account, leading to full compromise of the host.

References¶

• Vendor Advisory
• CWE-306: Missing Authentication for Critical Function
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• NVD: CVE-2026-101767