Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers are actively exploiting CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite that leads to remote code execution, despite Oracle's recent patch. Additionally, analysis shows an Oracle PeopleSoft zero-day exploited by ShinyHunters since May involves three combined vulnerabilities enabling RCE. The vulnerabilities grant attackers database and system command execution privileges, potentially exposing financial, payroll, HR, and procurement records. Patching alone may not remove attackers who have installed web shells.
Key points
- CVE-2026-101767 actively exploited in Oracle EBS post-patch
- PeopleSoft zero-day combines three distinct vulnerabilities
- Attackers gain APPS database and OS command execution privileges
- Web shells may persist despite patching efforts
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
