Oracle EBS flaw under attack: can you prove your system wasn't hit?

The flaw

CVE-2026-101767 is a critical SQL injection vulnerability in Oracle E-Business Suite that lets an unauthenticated attacker remotely inject SQL commands and, under the right conditions, execute code on the server ^[1]. Oracle released a patch on 15 October 2026. Days later, exploitation attempts began ^[1].

For anyone running Oracle EBS, patching is the first step. The second is harder: can you show whether your system was compromised before the patch went in, and if so, what the attacker did?

The 24-hour clock

Think of it like losing your bank card. The clock starts when you notice it's gone, not when it suits you to report it.

Under the Cybersecurity Resilience Act, manufacturers of products with digital elements must report actively exploited vulnerabilities to ENISA's reporting platform within 24 hours of becoming aware ^[2]. For critical organisations in Sweden, the cybersecurity law sets the same deadline for sending an early warning about a significant incident ^[3].

That 24 hours counts from awareness, and proving when you became aware is the first evidence question. The second is what you found: which systems were affected, what actions the attacker took and when each step of your response happened.

The state of the logs

Logs are what tell you. Access logs, authentication logs, database query logs and application logs together show who connected, what commands ran and when. Without them, you're guessing.

But logs have a credibility problem. They're kept by the same people who could change them. If you're the one holding the log, and you're also the one a supervisor or an auditor is questioning, a log you could have edited quietly doesn't carry much weight.

For financial organisations, DORA's technical standard on ICT risk management requires logs to be protected against tampering, deletion and unauthorised access ^[4]. The Cybersecurity Resilience Act doesn't spell out how logs must be kept, but it does require manufacturers to document incidents ^[2]. When the question is whether you knew about an exploit on day one or day three, the logs had better be defensible.

Sealing what you found

This is where a digital witness fits. The thing to seal is each detection note, each log segment you rely on and each step of your incident timeline as it happens: first detection, escalation decision, the early warning, the incident report and the final report.

You seal a fingerprint of each record through the REST API, the SDK or the MCP server, as it is written. The record itself never leaves your systems. If someone later questions whether a log was changed after the fact, anyone you share the record with can calculate the fingerprint again and check it against the sealed one. If they match, nothing has changed. Change a single character and it won't match.

A sealed log doesn't make the log complete, accurate or sufficient. It just makes it checkable, by a third party who doesn't have to trust you.

What this means for you

If you run Oracle EBS:

• Patch the vulnerability if you haven't already, and document when the patch was applied.
• Check your logs for signs of exploitation: unusual database queries, unexpected authentication attempts and remote code execution patterns. Oracle and security researchers have published indicators of compromise ^[1].
• If you find signs of compromise, work out when you became aware. That's when the 24-hour clock starts for reporting duties under the CRA or the cybersecurity law.
• Ask whether your logs can show what an attacker did, and whether they can be checked by someone who doesn't work for you. Access controls and monitoring are the foundation. Sealing logs at short intervals is the step that makes them hold up when questioned.

If you develop software with digital elements:

• Know your reporting deadlines. Under the CRA, you have 24 hours from awareness to report an actively exploited vulnerability, 72 hours to send an incident notification if the flaw is being exploited against your product, and one month for a final report ^[2].
• Keep records of when you learned about an exploit, what you did and when each report was sent. Sealed records of each step mean you can show the timeline later without asking anyone to trust your word.

What to watch

The Cybersecurity Resilience Act applies from 11 September 2026 to manufacturers of products with digital elements placed on the EU market after that date ^[2]. Sweden's cybersecurity law came into force on 15 January 2026 ^[3].

Oracle EBS installations in financial organisations are also subject to DORA's operational resilience rules, including the requirement to protect logs against tampering ^[4].

For anyone managing incidents, the CRA's and the cybersecurity law's 24-hour deadlines make it harder to quietly work out what happened before telling anyone. The logs, and your ability to defend them, matter from day one.

How it would work

1. Your incident response system seals each detection note and each log segment as it is written, using the REST API or the SDK.
2. Each sealed record gets a witness ID and a verification link.
3. When a supervisor, an auditor or a court asks what you knew and when, you share the records and the verification links. They calculate the fingerprints and check them against the sealed ones.

The content stays with you. The fingerprints are public. The check is something anyone can do.

Get started at witniumchain.com. The first 2,000 witnesses a month are free, and the documentation walks you through sealing your first record in under ten minutes.