#horizon3

October 21, 2026

Oracle E-Business Suite CVE-2026-101767 chains unauthenticated SQL injection into host command execution. Horizon3 found that the default-permitted TCF servlet lets a network attacker run SQL as the privileged APPS database user and commands as the EBS application account. Versions 12.2.3 through 12.2.15 are affected and covered by Oracle’s October update; no active exploitation or standalone public exploit was claimed in the technical disclosure. · Vulnerabilities & Exploits
A public FortiSIEM exploit now targets CVE-2026-106173. Horizon3 found an unauthenticated gRPC service exposed on TCP/27918, where path traversal in SendQueryResult provides arbitrary file write and ultimately RCE. The flaw was patched on October 13; active exploitation has not been reported. · New Tools & Releases