# Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767) actively exploited and Oracle PeopleSoft SSRF-to-RCE chain (CVE-2026-35273) exploited by ShinyHunters (UNC6240)

> Active exploitation of CVE-2026-101767, an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet, was detected on 2026-10-27, one week after the October 2026 CPU patched it. CVE-2026-35273 is an unauthenticated SSRF-to-deserialization RCE chain in Oracle PeopleSoft PeopleTools (PSIGW/PSEMHUB) that ShinyHunters (UNC6240) exploited as a zero-day from 2026-05-27 against 100+ organizations, 68% higher education. Patching does not remove web shells or persistence already installed.

- **Published:** 2026-10-28T20:55:30Z
- **Last reviewed:** 2026-10-28T20:55:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4671
- **ID:** TL-2026-4671
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-101767, CVE-2026-35273

## Description

CVE-2026-101767 affects the Oracle Application Object Library (Core) component of Oracle E-Business Suite 12.2.3 through 12.2.15. An unauthenticated attacker sends a crafted HTTP request to the Thin Client Framework (TCF) servlet, reachable at /OA_HTML/AppsTCFServer and permitted by the default EBS URL firewall configuration, and executes SQL with the privileges of the APPS database user. Horizon3.ai, who reported the flaw, describes escalation from SQL execution to operating-system commands via the EBS application account. Oracle rated it CVSS 3.1 9.8 and fixed it in the October 2026 Critical Patch Update (released 2026-10-20). As of 2026-10-21 no public PoC or exploitation was known; Defused Cyber reported active exploitation on 2026-10-27. No official IOCs have been published. Horizon3.ai behavioral signals are unauthenticated POSTs to /OA_HTML/AppsTCFServer followed by SQL reconnaissance, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through Concurrent Manager.

CVE-2026-35273 affects Oracle PeopleSoft PeopleTools 8.61 and 8.62 (CVSS 9.8, unauthenticated, no user interaction). ZDI (Bobby Gould, Minh Giang, Lucas Miller) reported it as three distinct flaws on 2026-06-10, for which separate CVEs are being coordinated: (1) SSRF in the Integration Gateway (PSIGW /PSIGW/HttpListeningConnector) that reaches PSEMHUB through a localhost bypass; (2) file path control in the PSEMHUB ExecuteProcessActivityCommand that permits JSP web shell placement; (3) deserialization of untrusted data in PSEMHUB, where attacker-controlled XML in environment configuration directories is loaded via Java XMLDecoder. Oracle published an out-of-band advisory and fix (CPU187) on 2026-06-10.

Google Mandiant and GTIG attribute the campaign to UNC6240 (ShinyHunters), observed 2026-05-27 to 2026-06-09, and found it through exposed attacker staging directories. Attackers send 5-15 POSTs with serialized Java objects to /PSEMHUB/hub, using the percent-encoded path /%50SEMHUB/ to bypass WAF rules that match the literal path. Once a host is confirmed vulnerable, they run in-memory commands or drop JSP web shells (x.jsp, u.jsp, u2.jsp) in PSEMHUB.war. Reported post-exploitation tooling includes the SIDEEYE backdoor (masqueraded as Ple64.exe), the Neo-reGeorg tunneling toolkit, and MeshCentral 1.1.59 agents (meshagent32/64-azure-ops.exe) calling back to wss://azurenetfiles.net:443/agent.ashx. Lateral movement uses a per-victim [victim]_fanout.sh script that parses /etc/hosts and sprays hardcoded credentials over SSH with sshpass, then plants README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in PeopleSoft web and process-scheduler directories. Data is compressed with zstd and exfiltrated over SSH to 176.120.22.24, which also hosts a ShinyHunters data-leak-site mirror. The University of Nottingham (about 455,000 records) is a confirmed victim.

The source article headline refers to four Oracle issues; this record covers the EBS and PeopleSoft items. Defenders should patch, but also hunt for web shells, rogue XML files and MeshCentral agents, because patching does not remove existing persistence.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1110.003 Password Spraying
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1021.004 SSH
- T1570 Lateral Tool Transfer
- T1560.001 Archive via Utility
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1657 Financial Theft

## Sources

- [Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble (The Register)](https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121)
- [ShinyHunters targets education sector with Oracle PeopleSoft exploit (Google Cloud / Mandiant GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit)
- [Oracle Security Alert for CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html)
- [Oracle mitigates PeopleSoft zero-day exploited in data theft attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks)
- [ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/amp/)
- [CSA Research Note: Oracle PeopleSoft Zero-Day - ShinyHunters Breaches 100 Universities](https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/)
- [Oracle PeopleSoft RCE flaw used as zero-day in ongoing ShinyHunters campaign (Security Affairs)](https://securityaffairs.com/193543/cyber-crime/oracle-peoplesoft-rce-flaw-used-as-zero-day-in-ongoing-shinyhunters-campaign.html)
- [Oracle E-Business Suite CVE-2026-101767 - Prepare Now (Rescana)](https://www.rescana.com/post/oracle-e-business-suite-cve-2026-101767-prepare-now)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4671