Oracle faces critical vulnerabilities in E-Business Suite and PeopleSoft

Oracle is facing significant cybersecurity threats following the discovery of critical vulnerabilities in its E-Business Suite and PeopleSoft platforms.

A high-severity SQL injection flaw (CVE-2026-101767) has been identified in the Oracle E-Business Suite Thin Client Framework servlet. This vulnerability, rated 9.8 on the CVSS scale, allows unauthenticated attackers to execute remote code (RCE) with low complexity. Although Oracle released a patch in its October 2026 Critical Patch Update, threat intelligence firm Defused Cyber reported that attackers are already actively scanning for unpatched systems.

Simultaneously, the hacking group ShinyHunters has been linked to data breaches involving Oracle PeopleSoft. This incident involves a zero-day exploit composed of three distinct security flaws. Cybersecurity experts warn that simply applying patches may not be sufficient, as administrators must also ensure that any web shells established by attackers during the exploitation period are thoroughly removed.

Organizations managing sensitive data such as finance, payroll, and human resources are advised to apply all recent Oracle updates immediately and audit internet-facing instances for signs of compromise.