Two Oracle stories landed together.
E-Business Suite
Defused Cyber’s decoys caught exploit attempts on Oct. 27 against CVE-2026-101767 (CVSS 9.8), patched in last week’s Critical Patch Update. Horizon3.ai found it: an unauthenticated SQL injection in the Thin Client Framework servlet (/OA_HTML/AppsTCFServer) that runs SQL as the APPS user and chains to OS commands.
PeopleSoft
ZDI says the PeopleSoft bug ShinyHunters exploited from May 27 to June 9, mostly against universities, was actually three chained flaws, starting with an SSRF that reaches an internal management interface because PeopleSoft trusts its own loopback address. Oracle fixed it on June 10 as CVE-2026-35273 (PeopleTools 8.61 and 8.62).
My take
If you run EBS, patching this week isn’t optional. Attackers are already probing. And keep that TCF servlet away from the internet.
God Bless, and Needs Garlic!
