Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
Original title: Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
Attackers are probing CVE-2026-101767, a critical unauthenticated SQL injection in Oracle E-Business Suite that can lead to remote code execution, after Oracle patched it in its October release. Separately, TrendAI's Zero Day Initiative says the PeopleSoft zero-day tracked as CVE-2026-35273 is three bugs that chain to RCE. Mandiant confirmed ShinyHunters exploited it as a zero-day and later deployed web shells across many sectors. Oracle did not immediately respond.
Unconfirmed: Oracle has not confirmed successful exploitation of CVE-2026-101767, and separate CVEs for the three PeopleSoft bugs are not yet assigned.
- Defused Cyber saw exploratory exploits against EBS decoys on October 27.
- The EBS flaw runs SQL as APPS and commands as the application account.
- ZDI reported the PeopleSoft issues on June 10; Oracle patched them as one CVE.
- The chain is SSRF, arbitrary file write, and unsafe XML deserialization.
- Patching may leave web shells on systems already compromised.
Impact: Remote code execution and theft of business records
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite | — | October release |
| Oracle PeopleSoft | — | patch issued as CVE-2026-35273 |
- 1.Apply Oracle's October EBS patch for CVE-2026-101767.
- 2.Patch PeopleSoft and check compromised hosts for web shells.
- Vendors
- Oracle
- Products
- E-Business SuitePeopleSoft
- Threat actors
- ShinyHunters
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 | |
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
3 min read at theregister.comAttackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.