Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains

Enterprise Resource Planning (ERP) environments represent the crown jewels of enterprise architecture, housing core general ledger, human resources, procurement, and operational records. Modern threat actors increasingly bypass perimeter endpoints to target the underlying application servers and middleware handling enterprise data flows. A pair of critical vulnerability disclosures targeting Oracle E-Business Suite (EBS) and Oracle PeopleSoft highlights the compound risk when unauthenticated web-tier interfaces chain directly into backend database and operating system execution contexts.

Security teams managing mission-critical enterprise systems must address active threat operations targeting these platforms. On 27 October 2026, threat intelligence networks detected widespread exploratory probing against oracle ebs cve-2026-101767, an unauthenticated SQL injection vulnerability within the EBS Thin Client Framework (TCF) servlet. Simultaneously, analysis of CVE-2026-35273 in Oracle PeopleSoft revealed a three-stage exploit chain deployed as a zero-day by the ShinyHunters threat group to compromise over 100 enterprise and educational institutions.

Understanding these attack vectors requires analysing how legacy middleware servlets, default internal trusts, and file system handlers interact within multi-tier ERP architectures. This technical breakdown evaluates the execution pathways of both vulnerabilities, details indicators of compromise (IoCs), and outlines concrete mitigation procedures for platform administrators and incident response teams.

Enterprise ERP Security Under Siege: Oracle EBS and PeopleSoft Vulnerabilities

Enterprise resource management applications present unique defensive challenges due to their longevity, structural complexity, and deeply intertwined privilege models. Oracle E-Business Suite and Oracle PeopleSoft sit at the centre of organizational data processing. Compromise of either platform grants threat actors direct visibility into sensitive corporate assets, operational intellectual property, employee personal identifiable information (PII), and financial accounts.

The operational risk is magnified by the multi-tier deployment models standard in enterprise environments. An HTTP or HTTPS web request entering through an internet-facing reverse proxy or web application firewall (WAF) often terminates at an application web tier running WebLogic Server, Oracle HTTP Server (OHS), or embedded Java servlets. When unauthenticated endpoints within these servlets fail to validate incoming parameters, attackers gain direct access to communicate with backend database layers or system execution daemons.

Threat actors have shifted from opportunistic scanning toward targeted exploitation of ERP business logic and legacy integration interfaces. In Oracle EBS, legacy components such as the Thin Client Framework (TCF) remain embedded within application deployments to maintain backwards compatibility for specific Java applets and internal modules. In Oracle PeopleSoft, integration infrastructure like the PeopleSoft Integration Gateway (PSIGW) and the PeopleSoft Environment Management Hub (PSEMHUB) exposes administrative endpoints that, if improperly secured, allow external callers to execute internal commands.

Dissecting Oracle EBS CVE-2026-101767: The TCF Servlet Vulnerability

Discovered and reported to Oracle on 24 July 2026 by researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai, CVE-2026-101767 received a maximum-severity CVSS score of 9.8. The vulnerability resides within the Application Object Library (FND) of Oracle E-Business Suite and stems from flawed input sanitisation in the Thin Client Framework servlet.

The target servlet class, oracle.apps.fnd.tcf.SocketServer, is mapped to the URL path /OA_HTML/AppsTCFServer. TCF was historically engineered to bridge lightweight clients and Java applets with backend EBS logic over HTTP or direct socket connections. When an unauthenticated web request is submitted to /OA_HTML/AppsTCFServer, the servlet processes incoming payload objects without enforcing mandatory session authentication checks.

# Conceptual structural layout of the vulnerable EBS web-to-database path
Client (Attacker)
   │
   ├── [ HTTP POST /OA_HTML/AppsTCFServer ] 
   │   (Unauthenticated request handling)
   ▼
Oracle HTTP Server / WebLogic (EBS Web Tier)
   │
   ├── Maps request to oracle.apps.fnd.tcf.SocketServer
   │   (Fails input validation & session verification)
   ▼
Oracle Database Tier (APPS Schema)
   │
   ├── Executes SQL statements with APPS superuser privileges
   ▼
Operating System Layer
   ├── Spawns process via Concurrent Manager / EBS App Account (/bin/sh)

By crafting a malicious POST request targeting the servlet, an attacker injects arbitrary SQL commands into the parsing engine. Because the servlet executes backend database calls using the primary application connection pool, the injected SQL commands run under the context of the highly privileged APPS database schema.

Oracle addressed this flaw in its October 2026 Critical Patch Update (CPU). However, environments that have not applied the patch or implemented network-level access restrictions remain exposed to unauthenticated execution.

From SQL Injection to System Execution: The EBS RCE Attack Chain

The transition from database-level SQL injection to full operating system Remote Code Execution (RCE) in Oracle E-Business Suite leverages the design of the APPS user account and the EBS Concurrent Manager framework.

Database Privileges of the APPS User

In an Oracle EBS database, the APPS user is a unified schema containing full read, write, and execute permissions across all application data modules (including Financials, HRMS, Supply Chain, and CRM). Obtaining SQL execution capabilities within the APPS user context bypasses row-level security and application-level role restrictions. An attacker can execute arbitrary PL/SQL blocks, alter database objects, extract credentials, and manipulate administrative tables.

Operating System Execution via Concurrent Manager

SQL injection alone exposes database records, but the TCF exploit chain extends directly to OS command execution. In a standard EBS architecture, system administration tasks, report generation, and batch jobs run through the Concurrent Processing server daemon (Concurrent Manager). The Concurrent Manager runs under the host OS user account assigned to the EBS application installation (typically named applmgr or oracle).

An attacker leveraging SQL injection via /OA_HTML/AppsTCFServer can manipulate internal queue tables or invoke database packages designed to communicate with the Concurrent Manager (such as FND_SUBMIT or underlying system execution procedures). This interaction forces the EBS application process to spawn host command interpreters—specifically /bin/sh or /bin/bash—on the underlying application server.

In the Wild: Probing Dynamics and Historical EBS Exploitation

According to reporting by The Hacker News, telemetry from threat intelligence firm Defused Cyber recorded active exploratory scanning against CVE-2026-101767 on 27 October 2026. Honeypot deployments and decoy EBS endpoints logged unauthenticated POST requests targeting /OA_HTML/AppsTCFServer, designed to test for servlet responsiveness and SQL injection vulnerability state.

The specific identity of the threat actors conducting these initial probing sweeps has not been publicly confirmed by security researchers or vendor advisories. Security teams should monitor traffic logs for attempts to instantiate specific Java helper classes, such as oracle.apps.jtf.gantt.server.GanttDataServer, sent inside payload structures directed at the TCF servlet endpoint.

This pattern mirrors prior EBS exploitation cycles. As detailed by The Register, critical vulnerabilities like CVE-2025-61882 were previously weaponised by threat groups such as Cl0p to harvest corporate data and deploy extortion demands. The rapid shift from patch availability to active scanning underscores the automated nature of modern enterprise vulnerability discovery.

Deconstructing PeopleSoft CVE-2026-35273: Anatomy of Three Interlinked Flaws

While Oracle EBS faced new TCF servlet probing, detailed technical analysis published by Trend Micro’s Zero Day Initiative (ZDI) revealed that Oracle PeopleSoft vulnerability CVE-2026-35273 represents an aggregation of three distinct, interlinked vulnerabilities. Researchers Bobby Gould, Minh Giang, and Lucas Miller submitted these findings to Oracle on 10 June 2026. Although assigned a single tracking identifier by Oracle, the attack chain relies on three structural flaws across the PeopleSoft Integration Gateway (PSIGW) and the PeopleSoft Environment Management Hub (PSEMHUB).

# The Three-Stage PeopleSoft CVE-2026-35273 Attack Chain
Stage 1: PSIGW SSRF
   │
   ├── Attacker sends HTTP request to PSIGW
   ├── Bypasses 'validateClient' by spoofing/routing via default localhost trust
   ▼
Stage 2: Path Control in PSEMHUB
   │
   ├── Reaches ExecuteProcessActivityCommand handler on PSEMHUB
   ├── Writes malicious webshell file into web-accessible server directory
   ▼
Stage 3: Untrusted XML Deserialization
   │
   ├── Plants serialized XML object in environment configuration path
   ├── Triggered automatically on service/system restart for persistent RCE

Bug 1: PSIGW Server-Side Request Forgery (SSRF)

The initial entry point uses an SSRF flaw in the PeopleSoft Integration Gateway (PSIGW). To protect gateway endpoints, Oracle introduced a validateClient access control mechanism designed to evaluate incoming requests against access rules. However, the implementation grants automatic implicit trust to requests originating from localhost (127.0.0.1).

The SSRF vulnerability allows an external attacker to construct an HTTP request to PSIGW that forces the gateway to issue a secondary internal request to PSEMHUB on behalf of localhost. This completely bypasses the validateClient restriction, providing full access to administrative endpoints residing within PSEMHUB that were intended to be unreachable from external networks.

Bug 2: File Path Control Flaw in PSEMHUB

Once the attacker achieves internal request routing to PSEMHUB via the SSRF, they target the ExecuteProcessActivityCommand message handler. This handler was designed to record diagnostic and log data sent by remote environment management agents to the PeopleSoft application filesystem.

Because the handler fails to validate and restrict destination file paths, an attacker can specify arbitrary directory paths and file extensions. By pointing the path parameter to a web-accessible application directory (such as a directory served by WebLogic), the attacker writes a JSP web shell or arbitrary script directly to the disk.

Bug 3: Untrusted XML Deserialization in PSEMHUB

The third component involves an untrusted XML deserialization vulnerability inside PSEMHUB. Using the arbitrary file write capabilities of Bug 2, an attacker can drop a crafted XML file containing serialized Java objects into directory paths monitored by PeopleSoft for environment configuration and service definitions.

When the PSEMHUB service initialises—such as during an administrative restart, system reboot, or scheduled process restart—the application reads and deserializes the malicious XML payload. This triggers payload execution in the context of the underlying application server daemon, providing persistent system execution regardless of whether web-facing endpoints are subsequently reconfigured.

The ShinyHunters Campaign: Zero-Day Exploitation and Persistent Web Shells

Prior to vendor patching, the PeopleSoft attack chain was actively exploited as a zero-day vulnerability. Threat intelligence reports from Mandiant confirm that the extortion group ShinyHunters began leveraging CVE-2026-35273 in May 2026, weeks before the ZDI disclosure in June.

Initial exploitation focused heavily on higher education institutions and university systems processing student records, financial aid data, and payroll information. However, by late September 2026, Mandiant documented a significant expansion in ShinyHunters’ target selection. The group deployed web shells across a broader array of sectors, including technology, IT services, healthcare, agriculture, transportation, and government agencies.

Over 100 organisations have been identified as impacted by this campaign. The total volume of exfiltrated data records and exact financial losses sustained across affected targets have not been publicly disclosed in available telemetry.

A critical operational lesson from the ShinyHunters campaign is that applying application-level patches or CPU updates does not evict an established adversary. Because Bug 2 allows attackers to plant arbitrary web shells in web-accessible directories, the patch only closes the initial entry vector. Pre-existing web shells remain fully accessible and executable via normal HTTP/HTTPS requests unless specifically identified and deleted during forensic remediation.

Defensive Operations: Detection Protocols, Workarounds, and Remediation

Defending ERP environments against active attack vectors requires a layered defensive posture combining network restrictions, log auditing, file system integrity monitoring, and emergency patching.

Oracle EBS CVE-2026-101767 Workarounds and Mitigations

If applying the October 2026 CPU to Oracle EBS cannot be executed immediately due to change management windows, system administrators must apply temporary network mitigations:

• URL Firewall Allowlist Exclusion: Remove access to the path /OA_HTML/AppsTCFServer (associated with class oracle.apps.fnd.tcf.SocketServer) at the reverse proxy, Web Application Firewall, or Oracle HTTP Server configuration layer.
• Web Tier Isolation: Enforce strict perimeter access controls on the EBS application web tier, restricting HTTP/HTTPS connections strictly to trusted corporate IP blocks or VPN gateways.
• Database Access Control: Audit and restrict network connections from the web tier to the database tier, ensuring only authorized WebLogic managed servers can reach database listener ports.

# Example Oracle HTTP Server (httpd.conf / mod_rewrite) block rule
# Test in staging before applying to production environments

<Location /OA_HTML/AppsTCFServer>
    Order deny,allow
    Deny from all
</Location>

# Alternatively using mod_rewrite to drop incoming requests
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/OA_HTML/AppsTCFServer [NC]
RewriteRule ^ - [F,L]

Detecting EBS Compromise and Probing

Security operations center (SOC) analysts and threat hunters should inspect web server access logs and database audit logs for specific indicators:

• HTTP POST Requests: Unauthenticated POST requests targeting /OA_HTML/AppsTCFServer that include references to oracle.apps.jtf.gantt.server.GanttDataServer or serialized Java objects.
• Reconnaissance Activity: Rapid sequences of SQL queries executing shortly after unauthenticated web requests, querying database version data, dba_users, current schema context, or database directory objects (e.g., ALL_DIRECTORIES).
• File System Artifacts: Unexpected temporary files, script artifacts, or binary drops located within the EBS temporary file directory defined by the $APPLPTMP environment variable.
• Process Tree Anomaly: The system process user running the Oracle database daemon or EBS Concurrent Manager spawning shell instances (e.g., /bin/sh, /bin/bash, perl, or python).

# Log inspection command to search for incoming TCF probing attempts
grep -Ei "AppsTCFServer" /u01/oracle/vis/inst/apps/*/logs/ora/10.1.3/Apache/access_log*

# Process audit command to inspect shell execution under the application service account
ps -ef | grep -E "(oracle|applmgr)" | grep -E "(/bin/sh|/bin/bash|perl|python)"

PeopleSoft Web Shell and Integrity Auditing

To detect and remediate potential ShinyHunters activity on PeopleSoft host deployments, infrastructure teams must execute full web shell hunting and file verification scripts across web tier directories.

# Locate newly created JSP files or altered scripts in WebLogic deployment paths
# Substitute <peoplesoft_web_dir> with your actual installation directory path
find <peoplesoft_web_dir> -name "*.jsp" -o -name "*.jspx" -mtime -180 -type f -exec ls -la {} +

# Search for suspicious file creation inside PSEMHUB and environment configuration paths
find /u01/app/peoplesoft/ -name "*.xml" -type f -exec grep -l "java.lang.ProcessBuilder" {} +

Monitoring by threat intelligence sources, including SecurityWeek, reinforces that applying vendor software updates must be paired with active host-level inspection to guarantee full eviction of web shell backdoors.

Key Takeaways for Enterprise Systems Engineering

Managing the security lifecycle of complex ERP applications like Oracle EBS and PeopleSoft requires moving beyond simple patch-and-forget routines. Because these systems combine legacy web frameworks with powerful backend database connections, defensive strategies must incorporate robust architectural boundaries.

• Prioritise ERP Patch Lifecycles: Establish expedited patch evaluation workflows for Oracle Critical Patch Updates. High-severity CVSS 9.8 vulnerabilities targeting web-accessible servlets should trigger emergency change control procedures.
• Eliminate Unnecessary Endpoint Exposure: De-couple administrative components (such as TCF, PSIGW, and PSEMHUB) from internet-accessible network routes. Legacy servlets that serve no external business function must be blocked at the web tier or firewall level.
• Post-Patch Threat Hunting: Never assume a patch resolves an active intrusion. When remediating zero-day flaws or publicly probed vulnerabilities, perform host-based file integrity monitoring, inspect temporary paths (like $APPLPTMP), and review system process lists for unauthorized shells.
• Apply Principle of Least Privilege to Middleware: Ensure application service accounts (e.g., applmgr, oracle) are isolated, lack sudo execution rights, and cannot write to executable web paths without explicit administrative override.

Frequently asked questions

What makes Oracle EBS CVE-2026-101767 particularly dangerous?

CVE-2026-101767 allows unauthenticated external users to execute SQL queries via the Thin Client Framework (TCF) servlet. Injected commands execute under the APPS database schema—the primary administrative account for Oracle EBS—enabling full data access and direct command execution on the host operating system.

How does the unauthenticated SQL injection in EBS lead to OS-level code execution?

Once an attacker executes SQL queries under the privileged APPS database schema, they can manipulate internal database queues or invoke standard packages that interface with the EBS Concurrent Manager framework. The Concurrent Manager daemon then spawns system shell processes, such as /bin/sh, under the application OS account.

Why is patching CVE-2026-35273 insufficient to guarantee security on a previously exposed PeopleSoft instance?

The attack chain for CVE-2026-35273 includes a file path control bug in PSEMHUB that allows attackers to drop JSP web shells onto the web server’s filesystem. Applying the code patch blocks future exploitation attempts but does not automatically delete web shell files planted prior to patching.

What temporary workarounds exist for CVE-2026-101767 if immediate patching is not feasible?

Organizations can restrict network access to the EBS web tier or configure firewall rules to block the URL path /OA_HTML/AppsTCFServer. Removing this servlet mapping prevents external callers from reaching the vulnerable oracle.apps.fnd.tcf.SocketServer class without disrupting non-TCF core web modules.