EN PT-BR
← Voltar ao feed
critical enterprise government healthcare education technology agriculture transportation

Threat actors probe newly patched Oracle EBS SQL injection flaw CVE-2026-101767 (CVSS 9.8)

4 fonte(s) · 4 atualização(ões) · publicado 28/10/2026 06:14 · coletado há 4 dias

Threat intelligence firm Defused (Defused Cyber) reports that threat actors began probing CVE-2026-101767, a critical (CVSS 9.8) SQL injection vulnerability in the Application Object Library product of Oracle E-Business Suite (EBS). Oracle patched the flaw in its October Critical Patch Update (CPU) on October 20 (bleepingcomputer.com) and urged customers to patch immediately. Defused's EBS decoys recorded the first exploratory exploitation attempts on October 27 (also reported by theregister.com). Oracle has not yet tagged the flaw as exploited in the wild (bleepingcomputer.com), and did not immediately answer The Register on whether it has documented successful exploitation (theregister.com). The flaw was discovered by Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King and reported to Oracle on July 24, 2026 (thehackernews.com); no other reports of in-the-wild exploitation exist. Shadowserver tracks over 670 Internet-exposed EBS instances, mostly in the United States, though it does not say how many are honeypots or already patched (bleepingcomputer.com). EBS has been a repeated target, including last year's Cl0p data-theft campaign that potentially affected over 100 organizations. Exploitation can expose financial, payroll, HR and procurement records and allow command execution on the application host (thehackernews.com).

In the related Oracle PeopleSoft story, TrendAI's Zero Day Initiative says the zero-day exploited by ShinyHunters involves three distinct vulnerabilities that chain to RCE, rather than the single CVE-2026-35273 Oracle patched. ZDI reported them on June 10 and is coordinating separate CVEs with Oracle (theregister.com). ShinyHunters told The Register in early June it had breached more than 100 organizations, and Mandiant later reported that by late September the group had deployed web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government (theregister.com). Patching alone may not remove attackers from already compromised systems.

Entenda a falha

A vulnerabilidade

CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet of the Application Object Library in Oracle E-Business Suite. An attacker needs only HTTP network access to the servlet, with no login and no user interaction. They can run SQL as the APPS database user, read or modify financial, payroll, HR and procurement data, and then run OS commands as the EBS application account. Oracle fixed it in the October 2026 CPU on October 20; the articles give no affected version numbers. Separately, ZDI says the PeopleSoft zero-day patched as CVE-2026-35273 is really three chained flaws (SSRF in PSIGW, file path control and unsafe deserialization in PSEMHUB) leading to RCE, and separate CVEs are being requested. CVE-2026-46817 (EBS Payments) and CVE-2025-61882 are older EBS bugs that were exploited.

Como funciona

Per Horizon3.ai, a crafted HTTP request reaches the TCF servlet exposed at /OA_HTML/AppsTCFServer. The servlet processes attacker-controlled data and ends up running SQL in the database as the APPS user; that is the step that goes wrong. From that database access the chain continues to command execution on the application host under the EBS application account. Horizon3.ai's indicators show the observable sequence: unauthenticated POSTs to that path instantiating a Gantt data-server class, backend database activity, SQL reconnaissance, then the oracle account spawning a shell through the Concurrent Manager. In the PeopleSoft chain, an SSRF in PSIGW reaches PSEMHUB from a trusted localhost, a file-write handler there stores attacker content, and a planted XML file is deserialized when PSEMHUB initializes.

Por que é vulnerável

The flaw is classed as SQL injection: input reaching the TCF servlet is not safely handled before it is used in database operations. The servlet is reachable without authentication, and the APPS account it uses is highly privileged, which raises the impact and enables the step to OS commands. The articles do not explain why it went unnoticed or what Oracle's patch changes. In the PeopleSoft chain, ZDI points to a validateClient restriction that trusts localhost by default, a handler that does not properly validate file paths, and deserialization of untrusted XML.

Onde está

The TCF servlet at /OA_HTML/AppsTCFServer (associated with oracle.apps.fnd.tcf.SocketServer) in the Application Object Library; the indicators also name oracle.apps.jtf.gantt.server.GanttDataServer. No public commit is named. For PeopleSoft: PSIGW and the PSEMHUB ExecuteProcessActivityCommand handler.

Como foi descoberta

Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the flaw and reported it to Oracle on July 24, 2026, per The Hacker News. Oracle patched it in the October CPU on October 20, and Horizon3.ai published an advisory with workarounds and indicators of compromise. Defused said its EBS decoys recorded exploratory attempts on October 27. Oracle had not tagged it as exploited and did not answer The Register on successful exploitation; the articles report no other in-the-wild activity. Shadowserver tracks over 670 exposed EBS instances, mostly in the US. The PeopleSoft bugs were found by ZDI's Bobby Gould, Minh Giang and Lucas Miller and reported on June 10.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 18:16.

Detalhes técnicos

  • CVE-2026-101767 is an SQL injection in the Application Object Library component of Oracle EBS.
  • It can be exploited by remote, unauthenticated attackers over HTTP in low-complexity attacks.
  • Defused describes it as an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution (bleepingcomputer.com).
  • Per the Horizon3.ai advisory (thehackernews.com), a crafted request to the TCF servlet at /OA_HTML/AppsTCFServer (associated with oracle.apps.fnd.tcf.SocketServer) runs SQL as the APPS database user, then OS commands as the EBS application account. Internal EBS systems are also exploitable if the servlet is reachable from a compromised host or another network segment.
  • Successful exploitation could lead to RCE and complete takeover of the Application Object Library.
  • Defused observed the activity on its EBS decoys on October 27 and described it as exploratory.
  • Horizon3.ai indicators of compromise (thehackernews.com): unauthenticated POST requests to /OA_HTML/AppsTCFServer instantiating oracle.apps.jtf.gantt.server.GanttDataServer followed by backend database activity; SQL reconnaissance (database version, current user, directory objects) after unauthenticated web requests; unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager.
  • In June, Defused also warned of attacks on CVE-2026-46817, a critical flaw in the File Transmissions component of the EBS Payments product.
  • Context (bleepingcomputer.com): Clop exploited EBS flaw CVE-2025-61882 in zero-day attacks from early August 2025, hitting Logitech, GlobalLogic, the Washington Post and US universities. ShinyHunters exploited PeopleSoft zero-day CVE-2026-35273 between May 27 and June 9, stealing data from organizations including Nottingham University, Nissan and NAIC. Since November 2021, CISA has added 46 Oracle bugs to its KEV list, 13 abused in ransomware attacks.
  • PeopleSoft chain per ZDI researchers Bobby Gould, Minh Giang and Lucas Miller (theregister.com): (1) SSRF in the PeopleSoft Integration Gateway (PSIGW) that bypasses the "validateClient" restriction Oracle added in June, since localhost is trusted by default, reaching PeopleSoft Environment Management Hub (PSEMHUB); (2) external control of file path in the PSEMHUB ExecuteProcessActivityCommand handler, allowing a web shell to be written for RCE; (3) deserialization of untrusted data in PSEMHUB, where a planted malicious XML file in the environment configuration directory is deserialized when PSEMHUB initializes, such as after a restart.

Remediação

  • Apply the Oracle October CPU patches to all EBS instances as a priority.
  • Remain on actively-supported versions and apply security patches without delay, per Oracle (bleepingcomputer.com).
  • If immediate patching is not possible (thehackernews.com): remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restrict access to the EBS web tier to trusted networks, and monitor the EBS application host and database for signs of compromise.
  • For PeopleSoft, patch CVE-2026-35273 and hunt for web shells and malicious XML configuration files, because patching does not remove existing compromises (theregister.com).

Relatos divergentes

  • Oracle patched the PeopleSoft zero-day under the single identifier CVE-2026-35273, as reported by theregister.com and bleepingcomputer.com. ZDI (via theregister.com, the more recent and authoritative source on the bug details) says it comprises three distinct vulnerabilities that should each receive their own CVE, and is coordinating this with Oracle.

Linha do tempo

  1. theregister.com ↗ · pub. 28/10/2026 16:56 · coletado 28/10 18:00

    Attackers probe patched Oracle EBS CVE-2026-101767; ZDI says ShinyHunters' PeopleSoft zero-day spans three vulnerabilities

    The Register adds that ZDI found the PeopleSoft zero-day exploited by ShinyHunters is really three chained vulnerabilities (PSIGW SSRF, PSEMHUB file path control, PSEMHUB deserialization) with separate CVEs pending. It also adds Mandiant's September report of web shells on dozens of systems across many sectors, and the warning that patching does not remove existing web shells.

    ler a análise desta fonte

    The Register adds that ZDI found the PeopleSoft zero-day exploited by ShinyHunters is really three chained vulnerabilities (PSIGW SSRF, PSEMHUB file path control, PSEMHUB deserialization) with separate CVEs pending. It also adds Mandiant's September report of web shells on dozens of systems across many sectors, and the warning that patching does not remove existing web shells.

    Attackers are probing CVE-2026-101767, a critical unauthenticated SQL injection in Oracle E-Business Suite that chains to RCE, even though Oracle patched it in its October release. Defused Cyber reported exploratory attempts against its EBS decoys on October 27. Separately, TrendAI's Zero Day Initiative says the PeopleSoft zero-day exploited by ShinyHunters since at least May involves three distinct vulnerabilities, not the single CVE-2026-35273 Oracle patched. Patching alone may not evict attackers who already planted web shells.

    Technical Details

    • CVE-2026-101767: unauthenticated SQL injection in the EBS Thin Client Framework servlet. It runs SQL as the APPS database user and enables OS command execution as the EBS application account. It was found by Horizon3 researchers. Data at risk includes financial, payroll, HR and procurement records.
    • PeopleSoft issue 1: SSRF in the PeopleSoft Integration Gateway (PSIGW). It bypasses the "validateClient" restriction Oracle added in June, because localhost is trusted by default, and reaches PSEMHUB.
    • PeopleSoft issue 2: external control of file path in the PSEMHUB ExecuteProcessActivityCommand handler. Requests are not validated, so an attacker can write a web shell and gain RCE.
    • PeopleSoft issue 3: deserialization of untrusted data in PSEMHUB. A file-write primitive plants a malicious XML file in the environment configuration directory, and it is deserialized when PSEMHUB initializes, for example after a restart.
    • ShinyHunters told The Register in early June that it had breached more than 100 organizations. Mandiant confirmed zero-day exploitation, mostly against education. By late September it reported web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government.
    • ZDI reported the three bugs on June 10 (researchers Bobby Gould, Minh Giang and Lucas Miller) and is coordinating separate CVEs with Oracle.

    Remediation

    • Apply the October Oracle EBS patch for CVE-2026-101767.
    • Apply the PeopleSoft patch for CVE-2026-35273, and hunt for web shells and malicious XML configuration files, since patching does not remove existing compromises.
  2. thehackernews.com ↗ · pub. 28/10/2026 09:48 · coletado 28/10 12:00

    Threat actors probe newly patched Oracle EBS unauthenticated SQLi-to-RCE flaw CVE-2026-101767 (CVSS 9.8)

    The Hacker News adds Horizon3.ai's technical advisory: the vulnerable endpoint (/OA_HTML/AppsTCFServer), the APPS database user to EBS application account privilege chain, indicators of compromise, the interim workarounds, the names of the credited researchers and the July 24, 2026 report date.

    ler a análise desta fonte

    The Hacker News adds Horizon3.ai's technical advisory: the vulnerable endpoint (/OA_HTML/AppsTCFServer), the APPS database user to EBS application account privilege chain, indicators of compromise, the interim workarounds, the names of the credited researchers and the July 24, 2026 report date.

    Threat intelligence firm Defused Cyber reports that its Oracle E-Business Suite (EBS) decoys recorded exploratory exploitation attempts on October 27 against CVE-2026-101767 (CVSS 9.8), only days after Oracle patched it in its Critical Patch Update. The flaw is an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet of the Oracle Application Object Library and chains to remote code execution. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the bug and reported it to Oracle on July 24, 2026. Successful exploitation exposes financial, payroll, HR and procurement data and allows command execution on the EBS application host. EBS has been a repeated target, including the Cl0p campaign abusing CVE-2025-61882 and the exploited CVE-2026-46817.

    Technical Details

    • An attacker sends a crafted request to the TCF servlet at /OA_HTML/AppsTCFServer (associated with oracle.apps.fnd.tcf.SocketServer) to run SQL as the APPS database user, then runs OS commands as the EBS application account.
    • Internet-facing EBS deployments carry the most risk, but internal systems are also exploitable if an attacker can reach the servlet from a compromised host or another network segment.
    • Horizon3.ai indicators of compromise:
      • Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.
      • SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects).
      • Unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands.

    Remediation

    • Update EBS to the latest patched version as soon as possible.
    • If patching is not immediately possible, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
    • Restrict access to the EBS web tier to trusted networks.
    • Monitor the EBS application host and database for signs of compromise, using the indicators above.
  3. bleepingcomputer.com ↗ · pub. 28/10/2026 09:19 · coletado 28/10 10:00

    Attackers scan for unpatched Oracle EBS flaw CVE-2026-101767 after October 2026 CPU

    The article adds that the patch shipped on October 20, that Defused describes the bug as an SQL injection in the Thin Client Framework servlet chaining to RCE, that Shadowserver tracks over 670 exposed EBS instances (mostly in the US), that Oracle has not yet tagged the flaw as exploited, and background on ShinyHunters' PeopleSoft campaign and CISA's KEV count for Oracle bugs.

    ler a análise desta fonte

    The article adds that the patch shipped on October 20, that Defused describes the bug as an SQL injection in the Thin Client Framework servlet chaining to RCE, that Shadowserver tracks over 670 exposed EBS instances (mostly in the US), that Oracle has not yet tagged the flaw as exploited, and background on ShinyHunters' PeopleSoft campaign and CISA's KEV count for Oracle bugs.

    Attackers have begun probing the Internet for Oracle E-Business Suite (EBS) systems unpatched against CVE-2026-101767, a critical flaw in the Application Object Library. The bug lets unauthenticated actors with HTTP access take over systems in low-complexity attacks. Oracle fixed it in its October 2026 Critical Patch Update on October 20, and has not yet flagged it as exploited in the wild. Threat intelligence firm Defused recorded exploratory exploit attempts against its EBS decoys on October 27. Shadowserver tracks over 670 Internet-exposed EBS instances, mostly in the United States.

    Technical Details

    • CVE-2026-101767 is described by Defused as an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution.
    • Exploitation requires only HTTP network access and low complexity.
    • Shadowserver does not indicate how many of the 670+ exposed instances are honeypots or already patched.
    • Context: Clop exploited EBS flaw CVE-2025-61882 in zero-day attacks from early August 2025 (victims include Logitech, GlobalLogic, the Washington Post and several US universities). ShinyHunters exploited PeopleSoft zero-day CVE-2026-35273 between May 27 and June 9.
    • Since November 2021, CISA has added 46 Oracle bugs to its KEV catalog, 13 of them abused in ransomware attacks.

    Remediation

    • Apply the October 2026 Oracle Critical Patch Update to all EBS instances immediately.
    • Remain on actively-supported versions, as Oracle recommends.
  4. securityweek.com ↗ · pub. 28/10/2026 06:14 · coletado 28/10 07:00 primeiro registro

    Threat actors probe newly patched Oracle EBS SQL injection flaw CVE-2026-101767 (CVSS 9.8)

    ler a análise desta fonte

    Threat intelligence firm Defused reports that threat actors began probing CVE-2026-101767, a critical (CVSS 9.8) SQL injection vulnerability in the Application Object Library product of Oracle E-Business Suite (EBS). Oracle patched the flaw in its October Critical Patch Update (CPU) last week. Defused's EBS decoys recorded the first exploratory exploitation attempts on October 27. The flaw was discovered and reported by Horizon3.ai, and no other reports of in-the-wild exploitation exist. EBS has been a repeated target, including last year's Cl0p data-theft campaign that potentially affected over 100 organizations.

    Technical Details

    • CVE-2026-101767 is an SQL injection in the Application Object Library component of Oracle EBS.
    • It can be exploited by remote, unauthenticated attackers over HTTP.
    • Successful exploitation could lead to remote code execution (RCE) and complete takeover of the Application Object Library.
    • Defused observed the activity on its EBS decoys on October 27 and described it as exploratory.
    • In June, Defused also warned of attacks on CVE-2026-46817, a critical flaw in the File Transmissions component of the EBS Payments product.

    Remediation

    • Apply the Oracle October CPU patches to all EBS instances as a priority.
    • The article does not give further mitigation guidance.