# Oracle Systems Face Critical RCE Vulnerabilities and Exploitation Risks Critical flaws in E-Business Suite and PeopleSoft demand immediate patching and forensic investigation. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d037d083-8eba-448d-93e7-77461020a9ed ## E-Business Suite SQL Injection Oracle E-Business Suite is currently facing active exploitation attempts targeting CVE-2026-101767. This critical, unauthenticated SQL injection vulnerability exists within the Thin Client Framework servlet. Attackers can leverage this flaw to execute commands with APPS database user privileges, potentially exposing sensitive financial, payroll, HR, and procurement records across compromised enterprise deployments. ## Active Probing and Exploitation Defused Cyber reported observing exploratory exploits against the EBS vulnerability on October 27. While Oracle released a patch earlier this month, the presence of active probing suggests that attackers are aggressively scanning for unpatched instances. Organizations must verify their patch status immediately to prevent unauthorized access to their internal application data. ## PeopleSoft Zero-Day Complexity The PeopleSoft security incident involving ShinyHunters is more complex than initially reported under CVE-2026-35273. Researchers at TrendAI’s Zero Day Initiative identified three distinct vulnerabilities that were previously grouped together. These bugs, reported in June, allow attackers to gain remote code execution by chaining specific flaws across multiple PeopleSoft components. ## SSRF and Access Bypass The first component of the PeopleSoft chain is a Server-Side Request Forgery vulnerability in the Integration Gateway. Although Oracle introduced a validateClient method to restrict access, attackers on trusted hosts can bypass these requirements. By reaching the PSEMHUB, malicious actors exploit the default localhost trust to initiate further unauthorized system requests. ## File Path Manipulation Risks The second vulnerability involves improper validation within the PSEMHUB ExecuteProcessActivityCommand handler. Designed to allow remote clients to write log entries, the handler fails to sanitize file paths correctly. This oversight enables attackers to write web shells directly onto the server filesystem, establishing a persistent foothold for remote code execution. ## Deserialization and Malicious XML The final vulnerability in the chain involves the deserialization of untrusted data within PSEMHUB. Attackers plant a malicious XML file in the configuration directory, which executes upon system restart. This triggers the deserialization process, completing the attack chain and granting the adversary full control over the affected PeopleSoft application instance. ## Broad Sector Impact Analysis Mandiant confirmed that ShinyHunters utilized the PeopleSoft zero-day to target over 100 organizations globally. While initial attacks focused on the education sector, the campaign expanded by late September. Affected industries now include technology, IT services, healthcare, agriculture, and transportation, demonstrating the wide-reaching impact of these unpatched or improperly secured enterprise systems. ## Post-Patch Security Realities Patching alone may not be sufficient if attackers have already deployed web shells or established persistence. Security teams must conduct thorough forensic investigations to ensure no unauthorized backdoors remain active. Future remediation requires assigning separate CVE identifiers for each distinct vulnerability to ensure accurate tracking and comprehensive mitigation of complex attack chains. ## Sources covering this story - https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._