Security researchers warn that a critical Oracle E-Business Suite vulnerability is already being probed in the wild despite a patch, while new analysis reveals that the PeopleSoft zero-day exploited by the ShinyHunters group is actually three distinct bugs that can be chained for remote code execution.
Attackers are actively probing a critical Oracle E-Business Suite (EBS) vulnerability that can lead to remote code execution (RCE), even though Oracle issued a patch earlier this month. According to a post from security firm Defused Cyber on X, their EBS decoys recorded exploratory exploits against the flaw, tracked as CVE-2026-101767, on the morning of October 27. The vulnerability is an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution.
Horizon3 researchers discovered and disclosed the bug to Oracle, which patched it in its October release. Horizon3 explained that an attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user, and the attack chain also enables operating system command execution with the privileges of the EBS application account. This means an unauthorized user can modify application data accessible to APPS, including financial, payroll, HR, and procurement records, depending on the deployment. The Register reached out to Oracle with multiple questions, including whether it has documented successful exploitation, and did not receive an immediate response.
Separately, new analysis of the PeopleSoft zero-day exploited by ShinyHunters reveals it is actually three distinct vulnerabilities. TrendAI's Zero Day Initiative (ZDI) found and reported the issues to Oracle on June 10, and Oracle issued a patch under a single identifier: CVE-2026-35273. In early June, ShinyHunters told The Register that the group had hacked more than 100 organizations via the zero-day. Mandiant later confirmed the group exploited it, mostly against schools and the education sector. By late September, Mandiant said ShinyHunters had massively expanded its targeting, deploying web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation, and government.
ZDI researcher Bobby Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally reported three distinct bugs. Gould says each should receive its own CVE identifier, and they are coordinating with Oracle to assign separate CVEs. The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold. Oracle introduced a "validateClient" method in June to restrict access, but the SSRF allows attackers to reach endpoints vulnerable to RCE. The second bug is an external control of file path vulnerability in PSEMHUB's ExecuteProcessActivityCommand handler, which allows an attacker to write a web shell into a file path. The third is a deserialization of untrusted data flaw in PSEMHUB, which can be triggered by planting a malicious XML file and waiting for initialization. Gould warned that attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft.
Patching alone may not remove attackers from already compromised systems, particularly if they have installed web shells.
Analysis
Why This Matters
- Active exploitation of a patched Oracle EBS vulnerability within days of the patch shows that attackers can move quickly, and organizations must prioritize patching to avoid falling victim.
- The PeopleSoft zero-day, previously thought to be a single flaw, is actually three bugs that can be combined for remote code execution, meaning the risk is higher and the fix may have been incomplete.
- If attackers have installed web shells, patching may not be enough; organizations may need to hunt for and remove backdoors to fully recover.
Background
Oracle E-Business Suite is a widely used enterprise resource planning application, often handling sensitive financial, payroll, and HR data. PeopleSoft is another Oracle product commonly deployed in higher education and government. Remote code execution vulnerabilities in such systems can allow attackers to take full control of servers and steal or modify critical data. The ShinyHunters group is known for data theft and extortion attacks, and has previously been linked to large-scale breaches.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe headline and opening say attackers were probing the EBS flaw after Oracle had patched it.www.theregister.com - Articles: “Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month.”
- SupportedThe headline says the PeopleSoft zero-day involved three distinct vulnerabilities.www.theregister.com - Articles: “new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE.”
- Partly supportedThe summary says ShinyHunters' PeopleSoft breach involved three distinct vulnerabilities.www.theregister.com - Articles: “an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities”
- SupportedDefused Cyber said its EBS decoys recorded exploratory exploits against CVE-2026-101767 on the morning of October 27.www.theregister.com - Articles: ““Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post.”
- SupportedCVE-2026-101767 is an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution.www.theregister.com - Articles: “an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution”
- SupportedHorizon3 researchers discovered and disclosed the EBS bug to Oracle.www.theregister.com - Articles: “Horizon3 researchers found and disclosed the bug to Oracle”
- SupportedOracle patched the EBS bug in its October release.www.theregister.com - Articles: “the vendor patched the issue in its October release.”
- SupportedZDI found and reported the PeopleSoft issues to Oracle on June 10.www.theregister.com - Articles: “TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10”
- SupportedOracle issued a PeopleSoft patch under the single identifier CVE-2026-35273.www.theregister.com - Articles: “Oracle issued a patch under one vulnerability identifier: CVE-2026-35273.”
- SupportedShinyHunters told The Register in early June that it had hacked more than 100 organizations via a PeopleSoft zero-day.www.theregister.com - Articles: “In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273.”
- SupportedBy late September, Mandiant said ShinyHunters had massively expanded its targeting, deploying web shells on dozens of systems globally across the listed sectors.www.theregister.com - Articles: “By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.””
- SupportedPatching alone may not remove attackers from already compromised systems, particularly if they installed web shells.www.theregister.com - Articles: “Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells.”
