"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27," Defused Cyber said in an X post.
CVE-2026-101767: an unauthenticated SQL injection with RCE potential
Researchers at Horizon3 disclosed a critical, unauthenticated SQL injection in Oracle E-Business Suite (EBS) — tracked as CVE-2026-101767 — and Oracle released a patch in its October update. Horizon3 explained that an attacker can send a crafted request to the Thin Client Framework servlet to execute SQL with the privileges of the APPS database user, and that the attack chain “also enables operating system command execution with the privileges of the EBS application account.”
The vulnerability therefore allows an unauthorized user to both modify application data accessible to APPS and execute operating-system commands. Horizon3 noted that, depending on deployment, affected data “may include financial, payroll, HR, and procurement records.” On Oct. 27 Defused Cyber’s EBS decoys recorded exploratory exploitation attempts. The Register reached out to Oracle with questions — including whether Oracle has documented any successful exploitation of CVE-2026-101767 — and did not receive an immediate response.
Horizon3 disclosure and Oracle’s October patch
Horizon3 researchers found and disclosed the EBS bug to Oracle, and Oracle shipped a fix in its October release. The presence of active probing against the vulnerability on Oct. 27 underscores the gap that can exist between patch availability and attacker activity: researchers and defenders must consider both rapid patching and detection/hunt programs to identify exploitation attempts.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogPeopleSoft zero-day: CVE-2026-35273 actually masks three separate flaws
TrendAI’s Zero Day Initiative (ZDI) found and reported PeopleSoft issues to Oracle on June 10; Oracle issued a patch under a single identifier, CVE-2026-35273. In early June, the extortion group ShinyHunters told The Register it had hacked more than 100 organizations using that PeopleSoft zero-day. Mandiant confirmed the group exploited CVE-2026-35273 as a zero-day, initially “mostly against schools and the education sector.” By late September Mandiant reported ShinyHunters had “deployed web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.”
Now ZDI researcher Bobby Gould says the PeopleSoft incidents are not a single flaw but three distinct vulnerabilities across multiple PeopleSoft components. Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three separate bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” Gould wrote in a Tuesday blog.
How the three PeopleSoft flaws chain to achieve remote code execution
- SSRF in PSIGW: A Server-Side Request Forgery in the PeopleSoft Integration Gateway (PSIGW) provides an initial foothold inside the PeopleSoft application by allowing attackers to reach internal endpoints. Gould noted Oracle introduced a “validateClient” method intended to restrict access, but the SSRF can make requests that satisfy that validation. Because Oracle allows localhost by default, the SSRF gives access to PSEMHUB.
- External control of file path in PSEMHUB: The ExecuteProcessActivityCommand handler in PeopleSoft Environment Management Hub (PSEMHUB) does not properly validate requests that write log entries to the server filesystem. That lapse permits an attacker to write a web shell to an accessible file path and obtain remote code execution.
- Deserialization of untrusted data in PSEMHUB: PSEMHUB reads environment configuration data from XML files. An attacker who can place a malicious XML file into a PeopleSoft configuration directory can trigger deserialization of that untrusted data when PSEMHUB initializes (for example, after a service or system restart), leading to possible remote code execution.
Gould warned that attackers can combine these three weaknesses — SSRF to reach PSEMHUB, file-write to plant a web shell, and deserialization to execute payloads at initialization — to compromise affected PeopleSoft instances.
What this means for security teams, education institutions, and incident responders
- Security teams: Patching is necessary but not sufficient. The source notes that "patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells." Teams must hunt for web shells, validate integrity of configuration directories, and inspect logs for SSRF exploitation.
- Education institutions and affected enterprises: Mandiant confirmed the PeopleSoft zero-day was used “mostly against schools and the education sector,” and later spread across healthcare, agriculture, transportation, government and other sectors. Organizations in those sectors should assume expanded targeting and prioritize detection of web shells and lateral activity even if they have applied Oracle’s patches.
- Incident responders and IR vendors: The events documented by Mandiant and the observation of deployed web shells on dozens of systems globally indicate that response priorities include credential and endpoint containment, removal of persisted web shells, and validation of whether attackers executed post-exploitation actions such as data theft or extortion.
Oracle has issued patches: one in October for EBS and a June patch for PeopleSoft under CVE-2026-35273, but researchers are pressing Oracle to assign separate CVEs for the three PeopleSoft issues. The register’s outreach about documented exploitation of CVE-2026-101767 went unanswered at the time of reporting. The raw fact is stark: researchers and defenders are racing to close holes that attackers have already tried — and in some cases used — to install persistent web shells that a simple patch will not necessarily remove.
