SAP fixed CVE-2026-89111, a maximum-severity OAuth2 SSRF in its Cloud SDK for Python, in a 20-flaw October 2026 update. A multi-tenant BTP app that lets outside input set tenant_subdomain can send its client credentials to an attacker until it is patched or allowlisted.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 64%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
The August 2026 Critical Security Patch Update carried 943 fixes across 23 product families, roughly 65% of Oracle's largest quarterly release. Monthly windows now need quarterly-sized capacity.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence65
ShinyHunters routes around PeopleSoft firewall rules to hit systems still missing Oracle's patch
ShinyHunters is mass-exploiting PeopleSoft systems that added firewall rules after the summer breaches but skipped Oracle's patch, Mandiant said. For operators that wrote a filter and stopped, the remedy in the report is the patch Oracle already shipped.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence40
ShinyHunters claims an Oracle PeopleSoft exploit opened the FBI's job application portal
The group told 404 Media it reached apply.fbijobs.gov through Oracle's PeopleSoft, and the FBI says the point of breach is still undetermined. Three of the bureau's recruiting pages have been serving error screens.
Reality
- Evidence52
- Adoption40
- Hype gap+32
- Incentives72
- Confidence55
Oracle's fifth monthly Critical Security Patch Update since May concentrates its unauthenticated remote flaws in Fusion Middleware and Hyperion, while the largest single batch of patches went to E-Business Suite.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence72