Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

Attackers are probing a critical Oracle E-Business Suite vulnerability that can allow unauthenticated remote code execution, even though Oracle issued a patch earlier this month. Separately, researchers say the PeopleSoft zero-day exploited by ShinyHunters comprises three vulnerabilities that can be combined to reach remote code execution.

The EBS flaw, CVE-2026-101767, affects the Thin Client Framework servlet and could expose application data such as financial, payroll, HR and procurement records. ShinyHunters claimed it had breached more than 100 organisations through the PeopleSoft issue, and Mandiant later reported web shells on dozens of systems across sectors including education, healthcare and government. Researchers are coordinating with Oracle to assign separate identifiers to the three PeopleSoft bugs; patching may not remove attackers already present on compromised systems.