Oracle EBS CVE-2026-101767: Unauthenticated SQL Injection That Chains to RCE

A crafted unauthenticated request to the Thin Client Framework servlet gives an attacker SQL execution as the APPS database user, and the attack chain goes on to operating system commands. Probing sta