Analyzing Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains

In late October 2026, threat intelligence monitoring identified active scanning and exploratory exploitation against a critical oracle ebs vulnerability tracked as CVE-2026-101767. Carrying a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to execute arbitrary SQL commands within the backend database under the high-privileged APPS schema. From this initial foothold, attackers can chain execution to run arbitrary operating system commands under the permissions of the Oracle E-Business Suite (EBS) application service account.

Concurrently, technical disclosures regarding Oracle enterprise software revealed that a zero-day vulnerability in Oracle PeopleSoft—tracked under CVE-2026-35273—is not a single defect, but rather a compound attack chain comprising three distinct vulnerabilities across the PeopleSoft Integration Gateway (PSIGW) and the PeopleSoft Environment Management Hub (PSEMHUB). Threat actors, including the ShinyHunters group, have actively exploited this PeopleSoft chain since May 2026 to breach more than 100 enterprise targets globally across higher education, healthcare, technology, and government sectors.

These developments emphasize severe operational risks inherent in managing enterprise resource planning (ERP) architectures. Because these environments consolidate sensitive business processes—including financial general ledgers, payroll systems, procurement records, and human resources databases—unauthenticated remote code execution (RCE) vulnerabilities present immediate catastrophic potential. Security teams must move beyond simple patch application to conduct threat hunting for persistent web shells and rogue database artifacts. For broader context on enterprise software exploitation, see our analysis of Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains.

Anatomy of Oracle EBS CVE-2026-101767

The Oracle Application Object Library (AOL) serves as the core infrastructure for Oracle E-Business Suite, providing foundational services such as application security, concurrent processing, and flexible field definitions. Within AOL, the Thin Client Framework (TCF) was designed to enable legacy client-side Java applets and mid-tier components to establish stateful communication channels with backend application engines and database sessions. The TCF architecture exposes an HTTP-accessible servlet mapped to the URL path /OA_HTML/AppsTCFServer, backed by the Java class oracle.apps.fnd.tcf.SocketServer.

CVE-2026-101767 originates from improper input sanitization and an absence of preliminary authentication checks within the HTTP request processing pipeline of /OA_HTML/AppsTCFServer. Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai discovered and disclosed this flaw to Oracle on 24 July 2026. When an unauthenticated client sends a specially crafted POST request to this endpoint, the servlet parses incoming object descriptors and forwards raw parameters directly into SQL statements executed against the database.

+-------------------+         Unauthenticated POST         +----------------------------------+
|  Remote Attacker  | ----------------------------------> |  Oracle HTTP Server / WebLogic   |
+-------------------+   /OA_HTML/AppsTCFServer Endpoint   +----------------------------------+
                                                                          |
                                                                          v
                                                          +----------------------------------+
                                                          |  oracle.apps.fnd.tcf.SocketServer|
                                                          |  Unauthenticated Input Parsing   |
                                                          +----------------------------------+
                                                                          |
                                                                          v
+-------------------+            OS Command Execution     +----------------------------------+
| EBS Host Shell    | <---------------------------------- | Oracle Database (APPS Schema)    |
| (applctx/oracle)  |  (DBMS_SCHEDULER / Java Stored Proc)| Executing arbitrary SQL queries  |
+-------------------+                                     +----------------------------------+

Because the TCF servlet operates within the context of the EBS application mid-tier, the database queries triggered by incoming HTTP payloads are evaluated under the database connection pool authenticated as the APPS database user. In Oracle EBS, the APPS schema is a highly privileged logical container that owns or holds full data-manipulation privileges over virtually all application tables, views, and stored packages. Consequently, unauthenticated SQL injection via TCF grants an attacker immediate, unrestricted read and write access to enterprise databases containing financial records, payroll data, supply chain metrics, and personally identifiable information (PII).

To escalate from SQL execution to remote code execution on the underlying host operating system, an attacker leverages built-in database packages and functionality accessible to the APPS user. Standard escalation paths include creating custom Java stored procedures, invoking the DBMS_SCHEDULER package to define operating system jobs, or manipulating PL/SQL packages such as UTL_FILE to write arbitrary executable scripts into system directories. When executed, these commands run under the privileges of the underlying Linux/Unix service account running the Oracle EBS mid-tier (typically oracle or applctx), completely breaching the host security boundary.

Exploitation Dynamics and Active Probing

Following Oracle’s release of a patch in the October Critical Patch Update, threat monitoring systems observed immediate external probing. On 27 October 2026, threat intelligence firm Defused Cyber recorded exploratory exploitation attempts against decoy Oracle EBS infrastructure. These early probes focused on identifying responsive /OA_HTML/AppsTCFServer endpoints and validating whether backend SQL injection vectors were accessible without authentication, as detailed in reports by The Hacker News and SecurityWeek.

The speed with which threat actors shifted from patch publication to active probing follows an established trend in enterprise software targeting. Enterprise application suites represent high-value assets for threat actors, particularly initial access brokers (IABs) and extortion groups. Historically, vulnerabilities in Oracle EBS have been aggressively targeted for automated initial access. For instance, CVE-2025-61882 (CVSS score 9.8) was heavily exploited by the Cl0p ransomware operator to execute automated exfiltration campaigns against corporate enterprise databases. Similarly, CVE-2026-46817 demonstrated how rapidly unauthenticated mid-tier flaws are operationalized by threat groups targeting ERP environments.

The structural risk of CVE-2026-101767 is compounded by differing deployment architectures across enterprise environments. Organizations exposing EBS web components directly to the public internet via Oracle HTTP Server (OHS) or reverse proxies face immediate risk. However, internally hosted EBS instances connected to corporate WANs or corporate VPN segments are also subject to exploitation if an attacker gains an initial foothold on an internal workstation or secondary server. Once an attacker routes traffic to the /OA_HTML/AppsTCFServer endpoint, internal network segmentation fails to stop data exfiltration if the application server maintains direct access to backend database listeners.

Dissecting the PeopleSoft Three-Bug Attack Chain

While CVE-2026-101767 impacts Oracle EBS, parallel developments in Oracle PeopleSoft highlight the vulnerability of complex multi-component enterprise software. Initially tracked under a single identifier, CVE-2026-35273, research published by TrendAI’s Zero Day Initiative (ZDI) revealed that the vulnerability actually comprises three distinct defects discovered and reported to Oracle on 10 June 2026 by researchers Bobby Gould, Minh Giang, and Lucas Miller.

Threat actors, including the ShinyHunters group, exploited this composite vulnerability as a zero-day starting in May 2026. Mandiant confirmed that the zero-day campaign affected over 100 organizations globally across sectors such as higher education, healthcare, technology, agriculture, transportation, and government agencies. Combining these three vulnerabilities creates an unauthenticated remote code execution chain that bypasses perimeter access controls and local trust boundaries. Detailed technical context was documented by The Register.

The first bug in the chain targets the PeopleSoft Integration Gateway (PSIGW). To protect sensitive administrative interfaces, Oracle previously implemented a security check called validateClient to restrict external HTTP calls. However, the SSRF vulnerability in PSIGW allows an unauthenticated external attacker to craft HTTP requests that fulfill the validation criteria. Because PeopleSoft configurations permit incoming requests originating from localhost or internal loopback interfaces by default, the SSRF grants the attacker the ability to make trusted, internal HTTP calls directly to the PeopleSoft Environment Management Hub (PSEMHUB).

+------------------+        External Request        +-----------------------+
| External Attacker| ------------------------------>| PSIGW (ValidateClient)|
+------------------+                                +-----------------------+
                                                                |
                                                      SSRF Loopback Request
                                                                v
+------------------+     Malicious XML File Write   +-----------------------+
|  Filesystem /    | <------------------------------|  PSEMHUB Interface    |
|  Web Shell Drop  |  (ExecuteProcessActivityCmd)   | (Trusted Local Host)  |
+------------------+                                +-----------------------+
         |
         | Service Restart
         v
+------------------+
| System RCE /     |
| Unsafe Deser.    |
+------------------+

Once loopback access to PSEMHUB is achieved via the PSIGW SSRF, the attacker triggers the second vulnerability: an external control of file path flaw in the ExecuteProcessActivityCommand message handler. Intended to allow client nodes to upload operational log files to the management hub, the handler fails to sanitize file paths supplied in incoming requests. Consequently, an attacker can specify arbitrary directory paths on the target host filesystem and write arbitrary file contents, including JSP web shells or malicious configuration files.

The third vulnerability resides within PSEMHUB’s environment configuration parser, which suffers from an unsafe deserialization of untrusted data defect. By using the file-write vulnerability to plant a crafted XML file inside the directory used by PSEMHUB for environment metadata, the attacker sets a persistent execution trap. When the PSEMHUB service or the underlying application server restarts, the application automatically reads and parses the XML configuration file, deserializing its contents and executing arbitrary code with system privileges.

Web Shell Persistence and Post-Compromise Realities

A primary operational challenge associated with both Oracle EBS CVE-2026-101767 and the PeopleSoft attack chain is that applying vendor patches does not remediate pre-existing compromise. When threat actors leverage arbitrary file write capabilities or SQL injection to execute OS commands, their immediate goal is establishing redundant, out-of-band persistence mechanisms that survive application updates and system restarts.

In the PeopleSoft zero-day campaign, Mandiant’s incident response teams observed threat actors deploying web shells directly into Java web application root directories mapped by Oracle WebLogic Server. Using the path traversal capability in ExecuteProcessActivityCommand, attackers wrote lightweight JSP web shells into directories such as /psft/pt85x/webserv/peoplesoft/applications/peoplesoft/PORTAL.war/. These web shells provided persistent, authenticated HTTP access to shell commands, completely bypassing the original vulnerabilities in PSIGW and PSEMHUB.

In Oracle EBS deployments exploited via CVE-2026-101767, post-compromise activity involves both filesystem persistence and database-level backdoors. Once an attacker obtains SQL execution as APPS, they can create persistent database triggers, add rogue administrative accounts to the FND_USER table, or register custom Concurrent Programs designed to run persistent shell scripts periodically. Forensic analysis across impacted enterprise environments shows that attackers routinely harvest database connection strings from localized configuration files (such as $CONTEXT_FILE in Oracle EBS), dump database tables containing encrypted passwords, and attempt lateral movement to domain controllers or backup systems. Note that exact exploitation volumes outside of reports by Defused Cyber and Mandiant have not been publicly disclosed by Oracle.

Indicators of Compromise and Detection Engineering

Detecting probing and active exploitation against Oracle EBS and PeopleSoft requires analyzing HTTP access logs, database execution traces, and OS process trees. Security operations centers (SOCs) and incident response teams should implement telemetry checks across all enterprise application boundaries.

1. HTTP Endpoint Inspection and Web Telemetry

Exploitation attempts against CVE-2026-101767 generate distinct web server log signatures. Inspect Oracle HTTP Server (OHS) and WebLogic access logs for unauthenticated POST requests targeting the Thin Client Framework endpoint that instantiate the Gantt data server class:

# Pattern Matching for TCF Gantt Data Server Exploitation
POST /OA_HTML/AppsTCFServer HTTP/1.1
Host: <ebs-hostname>
Content-Type: application/x-www-form-urlencoded

... Class=oracle.apps.jtf.gantt.server.GanttDataServer ...

A high volume of HTTP 200 or 500 responses to /OA_HTML/AppsTCFServer accompanied by payloads instantiating oracle.apps.jtf.gantt.server.GanttDataServer or other unlisted TCF classes indicates active exploitation attempts.

2. Database Activity and Privilege Escalation Queries

Following initial HTTP payload delivery, attackers execute automated SQL reconnaissance scripts. Monitor backend Oracle Database audit logs (such as DBA_AUDIT_TRAIL or Fine-Grained Auditing logs) for queries executed by the APPS account that examine database system metadata immediately following an unauthenticated web request:

-- Query to Audit Suspicious Reconnaissance Activity by APPS
SELECT timestamp, db_user, userhost, sql_text 
FROM dba_audit_trail 
WHERE db_user = 'APPS' 
  AND (
       LOWER(sql_text) LIKE '%v$version%' 
    OR LOWER(sql_text) LIKE '%all_directories%' 
    OR LOWER(sql_text) LIKE '%dba_tab_privs%'
    OR LOWER(sql_text) LIKE '%dbms_scheduler%'
  )
  AND timestamp > SYSDATE - 7
ORDER BY timestamp DESC;

3. Operating System Process Spawning

When an attacker escalates from SQL injection to OS command execution via Oracle EBS Concurrent Manager or database jobs, process execution monitoring (such as Endpoint Detection and Response telemetry or Auditd) will show unusual child processes spawned by the Oracle service user:

Additionally, inspect the default Oracle temporary file directory defined by the $APPLPTMP environment variable. The presence of newly created executable scripts, temporary shell output logs, or obfuscated batch files in $APPLPTMP is a strong indicator of active system compromise.

Mitigation and Emergency Workarounds

Organizations unable to deploy Oracle’s October Critical Patch Update immediately must enforce emergency containment controls to neutralize the exposure of /OA_HTML/AppsTCFServer and restrict mid-tier network access.

1. Disabling TCF Endpoint Access at the Web Tier

If business operations do not strictly require the legacy Thin Client Framework, administrators should block all external and internal web access to the AppsTCFServer servlet. This can be accomplished at the Oracle HTTP Server (OHS) layer by modifying the httpd.conf or mod_wl_ohs.conf configuration file to deny traffic to the vulnerable URL path:

# Workaround Rule for CVE-2026-101767: Block TCF Servlet Access
<LocationMatch "^/OA_HTML/AppsTCFServer">
    Order allow,deny
    Deny from all
</LocationMatch>

# Alternatively, using mod_rewrite rules to return a 403 Forbidden status
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/OA_HTML/AppsTCFServer [NC]
RewriteRule ^ - [F,L]

After applying these configuration changes, restart the Oracle HTTP Server service to enforce the block. Test access from a non-production staging environment to verify that attempts to reach https://<hostname>/OA_HTML/AppsTCFServer return an HTTP 403 Forbidden status code.

2. Restricting Network Visibility

Implement strict network security group (NSG) and firewall filtering rules around the Oracle EBS mid-tier servers. Limit incoming HTTP/HTTPS traffic to explicitly trusted internal subnets or dedicated enterprise reverse proxy servers. Ensure direct access to WebLogic admin ports (typically 7001/7002) and TCF socket ports is completely blocked from unauthenticated network segments.

3. Post-Incident Forensic Verification Checklist

Because patching or blocking endpoints does not clean up active web shells, incident response teams should execute the following forensic verification workflow across all EBS and PeopleSoft hosts:

• Web Root Audit: Perform file integrity checks on WebLogic web application paths (such as $OA_HTML in EBS or PORTAL.war in PeopleSoft) to identify newly created or modified .jsp, .jspx, or .php files created within the last 180 days.
• Temporary Directory Cleanup: Search $APPLPTMP, /tmp, and /var/tmp for hidden, executable, or unexpected file structures created by the oracle or applctx service accounts.
• Database User & Trigger Audit: Query DBA_USERS and DBA_TRIGGERS to verify that no unauthorized database schemas, system triggers, or administrative accounts have been provisioned under APPS.
• Credential Rotation: Force a full password reset for all database accounts, WebLogic domain passwords, and application service accounts, particularly if unauthenticated SQL execution was detected.

Architectural Takeaways for Enterprise ERP Security

The exploitation dynamics of CVE-2026-101767 and the PeopleSoft zero-day chain demonstrate recurring architectural vulnerabilities in enterprise application frameworks. Securing these platforms requires re-evaluating core architectural assumptions regarding network trust boundaries and component isolation.

A primary failure mode exposed by these vulnerabilities is the implicit reliance on localhost or loopback trust boundaries. Systems like PeopleSoft Integration Gateway and Environment Management Hub treated requests originating from local interfaces as inherently safe, enabling an SSRF vulnerability to bypass perimeter authentication controls entirely. Modern enterprise architecture must enforce explicit token-based authentication and mutual TLS (mTLS) for all inter-component and inter-service communications, regardless of whether the traffic originates from 127.0.0.1 or an external interface.

Furthermore, defense-in-depth within multi-tier enterprise Java environments requires enforcing rigid database privilege separation. Granting mid-tier database connection pools total ownership over application schemas—as seen with the APPS schema in Oracle EBS—means that any mid-tier SQL injection vulnerability immediately results in full database compromise. Enterprise security teams should evaluate implementing Fine-Grained Access Control (FGAC), Virtual Private Database (VPD) policies, and strict operating system privilege isolation to limit the blast radius when application-layer injection vectors are exploited.

Finally, organizations must adapt their patch management workflows to account for the speed of modern exploit development. The brief window between vendor patch releases and active exploitation probing—observed as less than two weeks in the case of CVE-2026-101767—demands automated asset discovery, pre-tested emergency firewall mitigation procedures, and continuous process-level threat hunting across core enterprise systems.

Frequently asked questions

What makes CVE-2026-101767 critical for Oracle EBS environments?

CVE-2026-101767 is critical because it allows unauthenticated remote attackers to execute arbitrary SQL commands as the highly privileged APPS database user. From there, attackers can escalate to host-level OS command execution under the EBS application account, exposing sensitive financial, payroll, and HR data without requiring valid credentials.

How does the Thin Client Framework servlet facilitate remote code execution?

The Thin Client Framework servlet at /OA_HTML/AppsTCFServer fails to sanitize unauthenticated incoming HTTP requests. Attackers inject malicious parameters into database queries executed by APPS, then leverage database packages or Java stored procedures to invoke operating system processes under the mid-tier application service account.

Why was CVE-2026-35273 in PeopleSoft split into three separate vulnerability mechanics?

While originally tracked under one identifier, research by TrendAI ZDI confirmed three distinct flaws: an SSRF in PSIGW that bypasses validateClient checks, an arbitrary file-write flaw in PSEMHUB ExecuteProcessActivityCommand, and an unsafe XML deserialization bug in PSEMHUB. Each targets a different component and mechanism in the attack chain.

Can patching alone remove an attacker who has already compromised a PeopleSoft or EBS instance?

No. Applying vendor security patches blocks the initial attack vectors but does not remove persistence mechanisms installed prior to patching. Attackers who have written web shells to disk, scheduled rogue database jobs, or modified configuration files retain access until those artifacts are forensically identified and removed.

What are the primary indicators that an EBS environment is being probed or exploited?

Key indicators include unauthenticated POST requests targeting /OA_HTML/AppsTCFServer instantiating GanttDataServer, database audit logs showing rapid metadata reconnaissance by the APPS user, unexpected files in $APPLPTMP, and process monitoring showing the oracle or applctx account spawning /bin/sh from Concurrent Manager binaries.