Threat reportVulnerabilityTL-2026-4671
Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767) actively exploited and Oracle PeopleSoft SSRF-to-RCE chain (CVE-2026-35273) exploited by ShinyHunters (UNC6240)
Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767) (TL-2026-4671), also tracked as Oracle PeopleSoft PSEMHUB zero-day, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-28. It is attributed to ShinyHunters with high confidence, affects Oracle E-Business Suite (Application Object Library / Thin Client, references 2 CVEs (CVE-2026-101767, CVE-2026-35273), maps to 16 MITRE ATT&CK techniques (T1018, T1021.004, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 1ShinyHunters
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4671
- Threat ID
- TL-2026-4671
- Also known as
- Oracle PeopleSoft PSEMHUB zero-day, Oracle EBS TCF SQL injection
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- ShinyHunters
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- higher education, technology, it services, health, agriculture, transport, government administration
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
Malware and tooling: Neo-reGeorg - S1189, SIDEEYE, MeshCentral, Neo-reGeorg, sshpass
How Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767) works
Active exploitation of CVE-2026-101767, an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet, was detected on 2026-10-27, one week after the October 2026 CPU patched it. CVE-2026-35273 is an unauthenticated SSRF-to-deserialization RCE chain in Oracle PeopleSoft PeopleTools (PSIGW/PSEMHUB) that ShinyHunters (UNC6240) exploited as a zero-day from 2026-05-27 against 100+ organizations, 68% higher education. Patching does not remove web shells or persistence already installed.
CVE-2026-101767 affects the Oracle Application Object Library (Core) component of Oracle E-Business Suite 12.2.3 through 12.2.15. An unauthenticated attacker sends a crafted HTTP request to the Thin Client Framework (TCF) servlet, reachable at /OA_HTML/AppsTCFServer and permitted by the default EBS URL firewall configuration, and executes SQL with the privileges of the APPS database user. Horizon3.ai, who reported the flaw, describes escalation from SQL execution to operating-system commands via the EBS application account. Oracle rated it CVSS 3.1 9.8 and fixed it in the October 2026 Critical Patch Update (released 2026-10-20). As of 2026-10-21 no public PoC or exploitation was known; Defused Cyber reported active exploitation on 2026-10-27. No official IOCs have been published. Horizon3.ai behavioral signals are unauthenticated POSTs to /OA_HTML/AppsTCFServer followed by SQL reconnaissance, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through Concurrent Manager.
CVE-2026-35273 affects Oracle PeopleSoft PeopleTools 8.61 and 8.62 (CVSS 9.8, unauthenticated, no user interaction). ZDI (Bobby Gould, Minh Giang, Lucas Miller) reported it as three distinct flaws on 2026-06-10, for which separate CVEs are being coordinated: (1) SSRF in the Integration Gateway (PSIGW /PSIGW/HttpListeningConnector) that reaches PSEMHUB through a localhost bypass; (2) file path control in the PSEMHUB ExecuteProcessActivityCommand that permits JSP web shell placement; (3) deserialization of untrusted data in PSEMHUB, where attacker-controlled XML in environment configuration directories is loaded via Java XMLDecoder. Oracle published an out-of-band advisory and fix (CPU187) on 2026-06-10.
Google Mandiant and GTIG attribute the campaign to UNC6240 (ShinyHunters), observed 2026-05-27 to 2026-06-09, and found it through exposed attacker staging directories. Attackers send 5-15 POSTs with serialized Java objects to /PSEMHUB/hub, using the percent-encoded path /%50SEMHUB/ to bypass WAF rules that match the literal path. Once a host is confirmed vulnerable, they run in-memory commands or drop JSP web shells (x.jsp, u.jsp, u2.jsp) in PSEMHUB.war. Reported post-exploitation tooling includes the SIDEEYE backdoor (masqueraded as Ple64.exe), the Neo-reGeorg tunneling toolkit, and MeshCentral 1.1.59 agents (meshagent32/64-azure-ops.exe) calling back to wss://azurenetfiles.net:443/agent.ashx. Lateral movement uses a per-victim [victim]_fanout.sh script that parses /etc/hosts and sprays hardcoded credentials over SSH with sshpass, then plants README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in PeopleSoft web and process-scheduler directories. Data is compressed with zstd and exfiltrated over SSH to 176.120.22.24, which also hosts a ShinyHunters data-leak-site mirror. The University of Nottingham (about 455,000 records) is a confirmed victim.
The source article headline refers to four Oracle issues; this record covers the EBS and PeopleSoft items. Defenders should patch, but also hunt for web shells, rogue XML files and MeshCentral agents, because patching does not remove existing persistence.
MITRE ATT&CK techniques used in TL-2026-4671
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery
Lateral Movement
T1021.004 SSH; T1570 Lateral Tool Transfer
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Exfiltration
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Execution
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools; T1572 Protocol Tunneling
Credential Access
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Collection
Reconnaissance
T1595.002 Vulnerability Scanning
Impact
Affected products and versions in Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
Remediation for Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
Patches
- Oracle October 2026 Critical Patch Update (CVE-2026-101767; My Oracle Support Note KA923 per Rescana)
- Oracle out-of-band patch CPU187 and June 2026 CPU (CVE-2026-35273)
Immediate actions
- Apply the October 2026 Oracle CPU to all Oracle E-Business Suite 12.2.3-12.2.15 environments
- Apply Oracle CPU187 / June 2026 CPU to PeopleSoft PeopleTools 8.61 and 8.62
- Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist as an interim measure and restrict the EBS web tier to trusted networks
- Disable the PeopleSoft Environment Management Hub on multi-server setups or remove the PSEMHUB application on single-server setups
- Block /PSEMHUB/* and /PSIGW/HttpListeningConnector, including percent-encoded variants such as /%50SEMHUB/, at the perimeter; do not rely on WAF body or literal-path rules alone
- Hunt for JSP web shells under PSEMHUB.war, unexpected XML under envmetadata/data/environment, and logs/persistantstorage/scratchpad directories under PSEMHUB
- Block the listed C2 and staging IPs and azurenetfiles.net; monitor outbound SMB (445) and WSS to azurenetfiles.net from PeopleSoft servers
Workarounds
- Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist
- Disable EMHub or remove PSEMHUB; block /PSEMHUB/* and /PSIGW/HttpListeningConnector at the network layer
Longer-term hardening
- Remove internet exposure of ERP administrative endpoints behind ZTNA or VPN allowlisting
- Establish a 72-hour emergency patching SLA for CVSS 9.0+ internet-reachable ERP components
- Rotate administrative credentials and SSH keys on any PeopleSoft host that may have been compromised and remove hardcoded or reused SSH credentials
- Deploy EDR and file-integrity monitoring on WebLogic and PeopleSoft hosts
CVEs associated with Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
Weaknesses (CWE) in Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
Timeline of Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
- UNC6240 / ShinyHunters begins exploiting the PeopleSoft PSEMHUB/PSIGW chain as a zero-day; MeshCentral 1.1.59 is installed on attacker staging infrastructure at 22:14 UTC and acme-client follows at 22:25 UTC.
- Stolen data appears on the ShinyHunters leak site and researchers publicly report exposed attacker staging directories; the observed exploitation window (2026-05-27 to 2026-06-09) closes.
- Oracle publishes an out-of-band security alert and fix (CPU187) for CVE-2026-35273; ZDI reports three distinct PeopleSoft flaws to Oracle the same day.
- Mandiant and Google Threat Intelligence Group publish analysis attributing the campaign to UNC6240 (ShinyHunters), with 100+ organizations affected, 68% higher education.
- Cloud Security Alliance publishes a research note covering 300+ compromised PeopleSoft instances and the University of Nottingham breach (about 455,000 records).
- Oracle releases the October 2026 Critical Patch Update fixing CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework servlet (CVSS 9.8).
- Rescana reports no public PoC, no confirmed in-the-wild exploitation, and no CISA KEV listing for CVE-2026-101767 at this point.
- Defused Cyber detects active exploitation attempts against CVE-2026-101767.
- The Register reports both issues, warning that patching alone may be insufficient if web shells are already installed.
Sources cited for Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767)
- Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble (The Register)
- ShinyHunters targets education sector with Oracle PeopleSoft exploit (Google Cloud / Mandiant GTIG)
- Oracle Security Alert for CVE-2026-35273
- Oracle mitigates PeopleSoft zero-day exploited in data theft attacks (BleepingComputer)
- ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks (BleepingComputer)
- CSA Research Note: Oracle PeopleSoft Zero-Day - ShinyHunters Breaches 100 Universities
- Oracle PeopleSoft RCE flaw used as zero-day in ongoing ShinyHunters campaign (Security Affairs)
- Oracle E-Business Suite CVE-2026-101767 - Prepare Now (Rescana)
Detection coverage for TL-2026-4671
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4671 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4671
6 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.