Top Highlights
- Critical flaw: CVE-2026-35273 chains three PeopleSoft vulnerabilities, enabling unauthenticated remote code execution (CVSS 9.8).
- How it works: An SSRF flaw reaches an internal admin interface because PeopleSoft trusts its own loopback address by default.
- Active exploitation: ShinyHunters used the bug as a zero-day in May–June, then expanded attacks across multiple industries worldwide.
- Defend now: Apply Oracle’s patch; if delayed, disable or remove PSEMHUB. Investigate for compromise and rotate exposed credentials—patching alone won’t remove attackers already inside.
One Bug, Three Linked Weaknesses
A PeopleSoft vulnerability that ShinyHunters exploited before Oracle patched it in June consists of three linked flaws, researchers say. Oracle fixed them under one identifier, CVE-2026-35273. The Zero Day Initiative is working with Oracle to assign separate identifiers to each weakness.
First, a flaw in PeopleSoft’s Integration Gateway lets attackers make the server send requests to other systems. They can direct those requests to an internal management tool. That tool trusts requests from the server’s own address, so it mistakes the attacker’s request for a safe, local one. Two further flaws let attackers use that access to run commands on the server.
Oracle released a fix on June 10. However, Mandiant and Google’s threat intelligence team say ShinyHunters exploited the flaws from May 27 to June 9, mostly at universities. A later campaign reached organizations in sectors including health care, transport, agriculture, and government. The vulnerability affects PeopleTools versions 8.61 and 8.62, and CISA lists it as actively exploited.
Why the Patch Matters
PeopleSoft supports important workplace systems, so a breach can put sensitive organizational data at risk. The attack also shows why a firewall alone may not protect an internal tool if another flaw lets outsiders reach it.
Organizations should install Oracle’s fix and use a supported PeopleTools release. If they cannot patch right away, Oracle advises disabling or removing the Environment Management Hub, depending on the setup. A web filter that blocks suspicious web addresses does not replace the patch, Mandiant warns.
Patching closes the known entry point, but it may not remove an intruder who already got in. Organizations that suspect a breach should check for malicious files, preserve evidence, and change credentials that the PeopleSoft server could access. ShinyHunters has stolen data and demanded payment, raising the risk of extortion as well as system disruption.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
