Vulnerabilities & Exploits · Zero-Day Exploit
Oracle EBS probes sharpen PeopleSoft’s patching problem Defused recorded exploratory probes on Oct. 27 against Oracle E-Business Suite’s newly patched CVE-2026-101767 ; the reports do not establish successful exploitation. Separately, the Zero Day Initiative says Oracle’s June fix for PeopleSoft CVE-2026-35273 bundled three chained flaws under one identifier. Mandiant and Google Threat Intelligence Group attributed pre-patch PeopleSoft attacks from May 27 to June 9 to UNC6240 , also known as ShinyHunters.
In PeopleSoft, the Integration Gateway can be tricked into forwarding a request to an internal management service that trusts requests from the server itself. That route lets an unauthenticated outsider reach a function meant to be internal and take over the server. ZDI says the flaws span two components; The Register reports patching alone may not remove web shells left by earlier intruders.
These are separate exposure tracks: EBS has probing, not confirmed compromise, while PeopleSoft systems exposed before the June fix may still carry attacker persistence. For PeopleSoft operators, a clean patch record cannot by itself establish that a previously compromised server is clean.
5 sources · Oct 28
NVD KEV
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 97% (100th percentile).
CISA federal remediation date Jun 15 · date passed
CVE-2026-101767 NVD KEV
CVSS 9.8 CRITICAL: vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). EPSS 0.6% (49th percentile).
Timeline Sources Oct 28 The Register Security
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns
original Oct 28 The Hacker News
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Oracle EBS decoys recorded probing of patched CVE-2026-101767, an unauthenticated SQL injection flaw that can lead to remote code execution.
original Oct 28 BleepingComputer
Hackers now scanning systems for recently-patched Oracle flaw
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.
original Part of the PlainSec briefing for 2026-10-27
Every edition of this story: Oracle EBS probes sharpen PeopleSoft’s patching problem
More from today Vulnerabilities & Exploits · Zero-Day Exploit
Oracle EBS probes sharpen PeopleSoft’s patching problem Defused recorded exploratory probes on Oct. 27 against Oracle E-Business Suite’s newly patched CVE-2026-101767 ; the reports do not establish successful exploitation. Separately, the Zero Day Initiative says Oracle’s June fix for PeopleSoft CVE-2026-35273 bundled three chained flaws under one identifier. Mandiant and Google Threat Intelligence Group attributed pre-patch PeopleSoft attacks from May 27 to June 9 to UNC6240 , also known as ShinyHunters.
In PeopleSoft, the Integration Gateway can be tricked into forwarding a request to an internal management service that trusts requests from the server itself. That route lets an unauthenticated outsider reach a function meant to be internal and take over the server. ZDI says the flaws span two components; The Register reports patching alone may not remove web shells left by earlier intruders.
These are separate exposure tracks: EBS has probing, not confirmed compromise, while PeopleSoft systems exposed before the June fix may still carry attacker persistence. For PeopleSoft operators, a clean patch record cannot by itself establish that a previously compromised server is clean.
5 sources · Oct 28
NVD KEV
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 97% (100th percentile).
CISA federal remediation date Jun 15 · date passed
CVE-2026-101767 NVD KEV
CVSS 9.8 CRITICAL: vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). EPSS 0.6% (49th percentile).
Timeline Sources Oct 28 The Register Security
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns
original Oct 28 The Hacker News
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Oracle EBS decoys recorded probing of patched CVE-2026-101767, an unauthenticated SQL injection flaw that can lead to remote code execution.
original Oct 28 BleepingComputer
Hackers now scanning systems for recently-patched Oracle flaw
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.
original Part of the PlainSec briefing for 2026-10-27
Every edition of this story: Oracle EBS probes sharpen PeopleSoft’s patching problem
More from today