Oracle Under Pressure: Attackers Probe Patched E-Business Suite Flaw as PeopleSoft Zero-Day Proves More Complex

Attackers are probing a critical Oracle E-Business Suite (EBS) vulnerability, CVE-2026-101767, even though Oracle patched it in its October release. Security firm Defused Cyber said its decoy EBS systems recorded exploratory attempts on 27 October. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that can lead to remote code execution. Horizon3 researchers, who found and reported the bug, said an attacker could run commands on the underlying system and change application data, which may include financial, payroll, HR and procurement records. The Register asked Oracle whether it has documented any successful exploitation but had not received an immediate response.

Separately, new analysis indicates that the Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve remote code execution. TrendAI's Zero Day Initiative reported the issues on 10 June, and Oracle patched them under a single identifier, CVE-2026-35273. ShinyHunters earlier told The Register it had compromised more than 100 organisations through the flaw, and Mandiant later confirmed the data theft and extortion group exploited it as a zero-day, mostly against schools and the education sector.

Patching alone may not remove attackers from systems that are already compromised, particularly if they have installed web shells.