Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

As Oracle celebrates the conclusion of Cybersecurity Awareness Month, it faces a dual threat of critical vulnerabilities. Attackers are actively probing a critical Oracle E-Business Suite bug (CVE-2026-101767) that can lead to remote code execution (RCE). This unauthenticated SQL injection flaw in Oracle's Thin Client Framework servlet can be chained to RCE, enabling unauthorized users to modify application data and execute OS commands.

While Oracle patched the issue in its October release, the vulnerability remains a concern as it could affect sensitive data such as financial, payroll, HR, and procurement records.

Meanwhile, Oracle's PeopleSoft platform encounters a separate yet interconnected crisis. TrendAI's Zero Day Initiative discovered and disclosed an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May. This vulnerability, CVE-2026-35273, involves three distinct flaws that can be combined to achieve RCE. Initially, ShinyHunters targeted over 100 organizations, primarily in the education sector, using this zero-day.

Later, Mandiant confirmed that ShinyHunters expanded its targeting, deploying web shells on dozens of systems globally, affecting higher education, technology, IT services, healthcare, agriculture, transportation, and government.

The PeopleSoft vulnerabilities include a Server-Side Request Forgery (SSRF) bug in the PeopleSoft Integration Gateway, allowing attackers to access vulnerable endpoints and execute RCE. Additionally, an external control of file path vulnerability in PeopleSoft's Environment Management Hub lets attackers write web shells to achieve RCE.

Lastly, a deserialization of untrusted data flaw in PeopleSoft's Hub enables attackers to plant malicious XML files, leading to RCE upon PSEMHUB initialization. Oracle has acknowledged the issue but has not yet assigned separate CVE identifiers to each vulnerability, posing a significant risk to affected systems.