Oracle cybersecurity vulnerabilities and data breaches

Oracle has faced significant cybersecurity challenges involving both large-scale data exposure and critical software vulnerabilities.

In October 2026, reports indicated that a cyberattack targeting legacy Cerner servers had exposed the sensitive personal and medical information of nearly 20 million people. The breach, which affected customers including the U.S. Department of Defense and various hospitals, included data such as Social Security numbers, medical diagnoses, and test results.

Concurrently, critical vulnerabilities were identified in Oracle’s E-Business Suite and PeopleSoft platforms. A high-severity SQL injection flaw in the E-Business Suite was rated 9.8 on the CVSS scale, allowing unauthenticated remote code execution. Additionally, the hacking group ShinyHunters was linked to data breaches involving PeopleSoft through a zero-day exploit. Experts warned that organizations must not only patch these systems but also audit for existing web shells established by attackers.