# Oracle Faces Critical Vulnerabilities in E-Business Suite and PeopleSoft Active exploitation of RCE flaws forces urgent security reviews for enterprise systems. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3c86c029-69f5-42b0-8d12-87864fed0fee ## E-Business Suite SQL Injection Oracle E-Business Suite is currently facing active probing regarding CVE-2026-101767, a critical unauthenticated SQL injection vulnerability. Discovered by Horizon3 researchers, this flaw allows attackers to execute commands with APPS database privileges. Although Oracle released a patch this October, security teams report ongoing exploratory exploits against the Thin Client Framework servlet. ## Scope of Potential Data Exposure The exploitation of the E-Business Suite vulnerability poses significant risks to sensitive enterprise data. Depending on specific system deployments, unauthorized users could potentially access financial, payroll, HR, and procurement records. Because the attack chain enables operating system command execution, the compromise extends beyond simple database queries to full application control. ## PeopleSoft Zero-Day Complexity The PeopleSoft security incident involving the ShinyHunters group is more complex than initially reported under CVE-2026-35273. Researchers from TrendAI’s Zero Day Initiative identified three distinct vulnerabilities instead of one. These bugs, reported in June, are currently being coordinated with Oracle to receive individual CVE identifiers to better reflect the underlying technical risks. ## The SSRF Foothold Mechanism The first component of the PeopleSoft chain is a Server-Side Request Forgery vulnerability in the Integration Gateway. While Oracle introduced a validateClient method to restrict access, attackers can bypass this by making requests that satisfy validation requirements. This allows them to reach the PSEMHUB, as Oracle permits localhost access by default. ## Web Shell Deployment Tactics The second vulnerability involves external control of file paths within the PSEMHUB ExecuteProcessActivityCommand handler. Designed for writing log entries, this handler lacks sufficient request validation. Attackers exploit this to write web shells directly into the server filesystem, achieving remote code execution and maintaining persistence even after initial security patches are applied. ## Deserialization and System Restart The third flaw in PSEMHUB involves the deserialization of untrusted data. Attackers plant malicious XML files within configuration directories using the aforementioned file-write vulnerability. Upon a service or system restart, the application initializes, triggering the deserialization process. This final step completes the attack chain, granting the adversary full remote code execution capabilities. ## Broad Impact of ShinyHunters Mandiant confirmed that the ShinyHunters group utilized these PeopleSoft vulnerabilities to target over 100 organizations. Initially focused on the education sector, the campaign expanded by late September to include technology, IT services, healthcare, agriculture, and government entities. The attackers have actively deployed web shells on dozens of systems globally to maintain unauthorized access. ## Post-Patch Security Realities Applying official patches is insufficient if systems were already compromised prior to the update. The presence of web shells means that attackers may retain access despite the remediation of the original vulnerabilities. Organizations must conduct thorough forensic investigations to ensure that no malicious persistence mechanisms remain active within their Oracle application environments. ## Sources covering this story - https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._