Critical vulnerabilities identified in REDAXO and Oracle E-Business Suite

Two major software vulnerabilities have been identified, posing significant security risks to enterprise systems.

REDAXO Core versions from 5.3.0 up to (but not including) 5.21.4 are affected by CVE-2026-117532. This vulnerability, rated with a CVSS score of 9.3, allows for authentication bypass. An attacker can forge temporary login tokens due to a predictable session secret, enabling unauthorized backend access and potential remote code execution outside of live mode. The flaw requires no user interaction and can be exploited over a network.

Oracle E-Business Suite (EBS) is facing threats from CVE-2026-101767, a vulnerability in the Oracle Application Object Library with a CVSS score of 9.8. This flaw involves an unauthenticated SQL injection that can escalate to Remote Code Execution (RCE) via the Thin Client Framework (TCF) endpoint. Security researchers have observed threat actors scanning for vulnerable systems immediately following the release of a patch, highlighting the urgency for organizations to update their EBS systems and secure their web tiers.