# Oracle Systems Face Critical RCE Vulnerabilities and Exploitation Risks Critical flaws in E-Business Suite and PeopleSoft demand immediate patching and forensic investigation. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2a2bb196-029c-41f9-b8ec-c29e367ac786 ## E-Business Suite SQL Injection Oracle's E-Business Suite is currently under active exploitation due to CVE-2026-101767, an unauthenticated SQL injection vulnerability. Discovered by Horizon3 researchers, this flaw allows attackers to execute commands with APPS database user privileges. Defused Cyber decoys confirmed exploratory probes against this specific vulnerability on October 27, despite the vendor releasing a patch earlier this month. ## Data Exposure Risks The exploitation of the E-Business Suite vulnerability grants unauthorized users access to sensitive application data. Depending on specific system deployments, compromised records may include payroll, financial, procurement, and HR information. Because the attack chain enables operating system command execution, attackers can potentially pivot deeper into the underlying infrastructure beyond the application layer. ## PeopleSoft Zero-Day Complexity The PeopleSoft security incident involving the ShinyHunters group is more complex than initially reported. While Oracle issued a single patch under CVE-2026-35273, researchers from TrendAI’s Zero Day Initiative identified three distinct vulnerabilities. These bugs were reported in June, and coordination is currently underway to assign separate CVE identifiers to each individual security flaw. ## SSRF as Initial Foothold The first PeopleSoft vulnerability is a Server-Side Request Forgery in the Integration Gateway. Although Oracle introduced a validation method to restrict access, attackers on trusted hosts can bypass these requirements. By leveraging the default localhost access allowed by Oracle, malicious actors can reach the Environment Management Hub to initiate further exploitation steps. ## Web Shell Deployment Mechanism The second flaw involves improper file path validation within the PSEMHUB ExecuteProcessActivityCommand handler. Designed to allow remote clients to write log entries, this handler fails to verify requests properly. Attackers exploit this to write web shells directly into the filesystem, establishing persistent remote code execution capabilities on the targeted PeopleSoft server instances. ## Deserialization Attack Vector The third vulnerability in PSEMHUB involves the deserialization of untrusted data. Attackers use the previously mentioned file-write flaw to plant a malicious XML configuration file. Upon system or service restart, the application deserializes this file, triggering remote code execution. This multi-stage attack chain demonstrates the necessity of addressing all three components. ## Broad Sector Impact Mandiant confirmed that ShinyHunters utilized these PeopleSoft vulnerabilities to compromise over 100 organizations. Initially targeting the education sector, the campaign expanded by late September to include technology, IT services, healthcare, agriculture, and government entities. The deployment of web shells across these global systems indicates a sophisticated, widespread extortion and data theft operation. ## Patching Limitations and Remediation Applying vendor patches is insufficient if attackers have already established persistence via web shells. Security teams must perform thorough forensic analysis to identify and remove unauthorized access points installed prior to patching. Organizations should assume that systems were compromised if they remained unpatched during the active exploitation period since early May. ## Sources covering this story - https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._