2 publishers · first seen Wed, 28 Oct 2026 06:04 UTC · updated Wed, 28 Oct 2026 19:56 UTC
Attackers are probing a critical Oracle E-Business Suite vulnerability, CVE-2026-101767, which can lead to remote code execution (RCE). Oracle issued a patch for this SQL injection bug earlier this month. Meanwhile, the Oracle PeopleSoft zero-day exploited by ShinyHunters since May involves three distinct vulnerabilities that can be combined to achieve RCE. Oracle patched all three under a single identifier, CVE-2026-35273, in June. The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. The second bug is an external control of file path vulnerability in PSEMHUB's ExecuteProcessActivityCommand handler, which allows an attacker to write a web shell into a file path and achieve RCE. The third vulnerability is a deserialization of untrusted data flaw in PSEMHUB, which can be triggered by a malicious XML file planted by an attacker.
Content auto-generated. May contain inaccuracies.