Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Oracle E-Business Suite and PeopleSoft face critical vulnerabilities, with attackers probing EBS bugs and ShinyHunters
Attackers are actively probing a critical SQL injection vulnerability in Oracle E-Business Suite (CVE-2026-101767) that can lead to remote code execution, despite Oracle having released a patch. Concurrently, a PeopleSoft zero-day exploited by ShinyHunters, initially identified as CVE-2026-35273, has been revealed to encompass three distinct vulnerabilities, allowing for combined exploitation to achieve RCE, with attackers deploying web shells on compromised systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Oracle?
Get an email when a new story names Oracle, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are actively exploiting a critical SQL injection vulnerability in Oracle E-Business Suite (CVE-2026-101767) even though Oracle had already released a patch, highlighting a dangerous gap between patch availability and patch deployment. Simultaneously, a PeopleSoft zero-day leveraged by ShinyHunters expanded from one known CVE into three chained vulnerabilities enabling remote code execution and web shell deployment, compounding the risk for unpatched organizations. This dual incident underscores how delayed patching of internet-facing enterprise applications creates broad attack surfaces for sophisticated threat actors. The deployment of web shells indicates attackers are establishing persistent footholds, meaning the window between exploitation and full compromise can be extremely short.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-101767
- cve — CVE-2026-35273