Oracle EBS and PeopleSoft hit by fresh vulnerability attacks

Attackers are probing CVE-2026-101767, a critical unauthenticated SQL injection in Oracle E-Business Suite that chains to remote code execution, despite an October patch. ZDI analysis shows the PeopleSoft zero-day exploited by ShinyHunters (CVE-2026-35273) actually comprises three distinct vulnerabilities.

• CVE-2026-101767 is an unauthenticated SQL injection in EBS chaining to RCE
• Oracle patched it in October, but exploit probes appeared on October 27
• ShinyHunters' PeopleSoft 0-day combines SSRF, file write and deserialization
• ZDI asks Oracle to assign separate CVEs to each of the three flaws