尽管甲骨文已于本月初发布了补丁，但攻击者仍在探测一个可导致远程代码执行（RCE）的甲骨文电子商务套件（Oracle E-Business Suite）严重漏洞。与此同时，新的分析表明，ShinyHunters早在5月利用的一个甲骨文PeopleSoft零日漏洞涉及三个不同的漏洞，组合起来可实现远程代码执行。仅靠打补丁可能无法将攻击者从已经遭入侵的系统中清除，特别是如果他们已经安装了Webshell。
Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells.
首先是CVE-2026-101767，这是甲骨文电子商务套件（EBS）中一个未经身份验证的严重SQL注入漏洞，可导致远程代码执行。Defused Cyber在X平台的一篇帖子中表示：“今天10月27日上午，我们的甲骨文电子商务套件诱捕系统记录了针对CVE-2026-101767的探测性攻击。这是EBS的“瘦客户端框架”（Thin Client Framework）servlet中的一个未经身份验证的SQL注入漏洞，可串联导致远程代码执行。”
First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post.
Horizon3的研究人员发现了该漏洞并向甲骨文进行了披露，该厂商在其10月的更新中修复了该问题。Horizon3当时解释称：“攻击者可以向易受攻击的servlet发送精心构造的请求，以APPS数据库用户的权限执行SQL。该攻击链还能够以EBS应用程序账户的权限执行操作系统命令。”这意味着未经授权的用户可以修改APPS可访问的应用程序数据，并执行命令。
Horizon3 researchers found and disclosed the bug to Oracle, and the vendor patched the issue in its October release. “An attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user,” Horizon3 explained at the time. “The attack chain also enables operating system command execution with the privileges of the EBS application account.”This means an unauthorized user can modify application data accessible to APPS, and execute commands.
漏洞猎手表示：“根据部署情况，受影响的数据可能包括财务、薪资、人力资源和采购记录。”他们就此报道向甲骨文提出了多个问题——包括甲骨文是否记录了任何对CVE-2026-101767的成功利用，但未立即收到回复。
“Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” the bug hunters said. The reached out to Oracle with multiple questions for this story - including whether it has documented any successful exploitation of CVE-2026-101767 - and did not receive an immediate response.
接下来是关于PeopleSoft与ShinyHunters的乱局：趋势科技（TrendAI）的“零日倡议”（ZDI）于6月10日发现并报告了PeopleSoft的问题，甲骨文在一个漏洞标识符CVE-2026-35273下发布了补丁。6月初，ShinyHunters向《The Reg》透露，该组织通过一个甲骨文PeopleSoft零日漏洞（CVE-2026-35273）黑了100多个组织。
Moving on to the PeopleSoft-ShinyHunters fiasco: TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10, and Oracle issued a patch under one vulnerability identifier: CVE-2026-35273. In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273.
谷歌的咨询与事件响应业务部门Mandiant随后证实，这个数据盗窃和勒索团伙将CVE-2026-35273作为零日漏洞进行了利用，主要针对学校和教育行业。然而，到9月下旬，Mandiant表示ShinyHunters大幅扩大了攻击目标，“在全球数十个系统上部署了Webshell，涵盖高等教育、技术、IT服务、医疗保健、农业、交通和政府行业”。
Google’s consulting and incident response biz, Mandiant, later confirmed the data theft and extortion crew exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector. By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.”
根据ZDI漏洞猎手鲍比·古尔德（Bobby Gould）的说法，实际上在多个PeopleSoft组件中存在三个不同的漏洞，每个漏洞都应该获得自己的CVE标识符，而不是被归并在CVE-2026-35273之下。古尔德与TrendAI的研究人员明江（Minh Giang）和卢卡斯·米勒（Lucas Miller）最初在6月发现了这三个不同的漏洞并向甲骨文进行了报告。他在周二的一篇博客中表示：“我们正在与甲骨文协调，为每个问题分配单独的CVE。”
According to ZDI bug hunter Bobby Gould, there are actually three distinct vulnerabilities across multiple PeopleSoft components, and each should receive its own CVE identifier rather than being grouped under CVE-2026-35273. Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three distinct bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” he said in a Tuesday blog.
第一个问题是PeopleSoft集成网关（PSIGW）中的服务器端请求伪造（SSRF）漏洞，这为攻击者提供了进入PeopleSoft应用程序的立足点。6月，甲骨文引入了“validateClient”方法，允许PeopleSoft系统管理员限制对某些功能的访问。然而，古尔德写道，SSRF漏洞允许犯罪分子发出满足验证要求的请求，从而访问易受RCE攻击的端点。
The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. In June, Oracle introduced a “validateClient” method to allow PeopleSoft system administrators to restrict access to certain functionality. The SSRF bug, however, allows crims to make requests that satisfy the validation requirement to access endpoints vulnerable to RCE, Gould wrote.
他谈到PeopleSoft环境管理中心（PSEMHUB）时表示：“虽然此解决方案确实限制了访问，但任何受信任主机上的攻击者仍然可以访问PSEMHUB。由于甲骨文默认允许本地主机，因此PSIGW SSRF提供了恰好这种访问权限。”
“While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB,” he said, referring to PeopleSoft Environment Management Hub (PSEMHUB). “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.”
第二个漏洞是PSEMHUB的ExecuteProcessActivityCommand处理程序中的外部控制文件路径漏洞。该消息处理程序旨在允许远程客户端向PeopleSoft服务器的文件系统写入日志条目——但它没有正确验证请求，这允许攻击者将Webshell写入文件路径并实现远程代码执行。
The second bug is an external control of file path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. This message handler is designed to allow remote clients to write log entries to the PeopleSoft server’s filesystem - but it doesn’t properly validate requests, which allows an attacker to write a web shell into a file path and achieve RCE.
第三个漏洞同样位于PSEMHUB中，是一个对不受信任数据进行反序列化的缺陷。攻击者可以利用文件写入漏洞，将一个恶意的XML文件植入存储环境配置数据的PeopleSoft目录中，然后等待PSEMHUB初始化（例如在服务或系统重启之后）。这会触发对恶意XML文件的反序列化，从而可能允许攻击者实现远程代码执行。
The third vulnerability, also in PSEMHUB, is a deserialization of untrusted data flaw. An attacker can use a file-write vulnerability to plant a malicious XML file inside a PeopleSoft directory that stores environment configuration data, then wait for PSEMHUB to initialize, such as after a service or system restart. This triggers deserialization of the malicious XML file, potentially allowing the attacker to achieve RCE.
古尔德警告称：“攻击者可以结合这些漏洞来攻陷受影响的PeopleSoft实例。”
“Attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft,” Gould warned.®