#Oracle
All CosmicBytez Labs articles tagged #Oracle, across news, security advisories, how-to guides, and projects.
- News
Oracle Health Data Breach Tally Climbs to Nearly 20 Million
A Texas AG filing and Bloomberg report put the Oracle Health/Cerner breach toll near 20 million, far above earlier state-by-state counts.
- News
ShinyHunters Bypass WAFs to Exploit Oracle PeopleSoft Flaw at Scale
Google warns ShinyHunters is mass-exploiting a patched PeopleSoft RCE flaw again, using URL-encoding to slip requests past WAFs.
- News
ShinyHunters Bypasses WAF Rules to Revive Oracle PeopleSoft Attacks
Google says ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273 by URL-encoding a single character past WAF rules.
- News
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA adds a maximum-severity Oracle WebLogic and HTTP Server flaw to the KEV catalog as active exploitation is confirmed in the wild.
- News
Hackers Run khunt Post-Exploitation Toolkit from Oracle Database
Threat actors exploited a SQL injection flaw to compile and execute the khunt post-exploitation toolkit directly inside an Oracle database using the...
- News
Estee Lauder Discloses Data Breach via Oracle E-Business Suite Flaw
Cosmetics giant Estee Lauder is notifying customers and employees of a data breach after threat actors exploited a vulnerability in Oracle E-Business...
- News
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
A critical CVSS 9.8 authentication bypass vulnerability in Oracle E-Business Suite's Payments module is being actively exploited in the wild, according to...
- News
NAIC Says Only Public Data Stolen in ShinyHunters PeopleSoft Breach
The National Association of Insurance Commissioners confirms ShinyHunters exploited an Oracle PeopleSoft zero-day but says only publicly available data,...
- News
Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day Attacks
Nissan warns that current and former employees had data stolen after threat actors exploited an Oracle PeopleSoft zero-day vulnerability tied to the...
- News
Google Confirms ShinyHunters Exploited Oracle PeopleSoft Zero-Day CVE-2026-35273
Google's Threat Intelligence Group confirmed in-the-wild exploitation of Oracle PeopleSoft zero-day CVE-2026-35273 by ShinyHunters, even as Oracle...
- News
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Education
The ShinyHunters hacking group exploited a critical Oracle PeopleSoft ERP zero-day (CVE-2026-35273) that disproportionately impacted American...
- News
Oracle Mitigates PeopleSoft Zero-Day Exploited in Data Theft Attacks
Oracle has issued an emergency mitigation for CVE-2026-35273, a critical unauthenticated RCE flaw in PeopleSoft Suite being actively exploited by the...
- News
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach Universities
The ShinyHunters group, tracked by Mandiant as UNC6240, has been exploiting CVE-2026-35273 in Oracle PeopleSoft to breach universities and higher...
- Security
CVE-2026-35273: Critical Oracle PeopleSoft RCE Exploited in the Wild
A CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is being actively exploited, with threat...
- Security
CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability allowing unauthenticated attackers network access via T3 and IIOP protocols, potentially exposing…
- Security
CVE-2026-34311 — Oracle Hospitality OPERA 5 Unauthenticated RCE
A CVSS 9.8 critical vulnerability in Oracle Hospitality OPERA 5 Property Services allows unauthenticated network attackers to fully compromise hotel...
- Security
CVE-2026-46775 — Oracle REST Data Services Critical Compromise via HTTPS
A CVSS 9.9 critical vulnerability in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged network attacker to fully...
- Security
CVE-2026-21997: Oracle Life Sciences Empirica Signal
A high-severity vulnerability in Oracle Life Sciences Empirica Signal versions 9.2.1-9.2.3 allows a low-privileged attacker with network access via HTTP...
- News
Oracle Pushes Emergency Fix for Critical Identity Manager
Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Oracle Identity Manager and...
- Security
CVE-2026-21992: Critical Oracle Identity Manager
Oracle's March 2026 Critical Patch Update includes CVE-2026-21992, a CVSS 9.8 unauthenticated remote code execution vulnerability in Oracle Identity...
- Security
CVE-2026-21994: Critical Unauthenticated RCE in Oracle Edge
A critical unauthenticated remote code execution vulnerability (CVSS 9.8) in Oracle's Edge Cloud Infrastructure Designer and Visualisation Toolkit allows...