Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day Attack Advisory

Oracle PeopleSoft versions 8.61 and 8.62 are vulnerable to a critical zero-day exploit chain tracked as CVE-2026-35273, carrying a CVSS score of 9.8. Organizations running these versions must immediately apply vendor security patches and follow strict credential rotation procedures if unauthorized access is suspected.

Understanding the Vulnerability Chain and Timeline

The security issue involves three chained vulnerabilities that allow unauthenticated attackers to achieve remote code execution over the network. The attack path starts with a server-side request forgery flaw in the Integration Gateway component, which fails to validate forwarding destinations. Attackers direct this traffic to the local loopback address because the Environment Management Hub trusts internal hosts by default. From there, malicious actors execute code either by abusing log-writing features to drop web shells or by supplying XML files that execute instructions upon service restart.

Researchers at the Zero Day Initiative reported these flaws to Oracle, leading to an out-of-band security alert and patch release on June 10. Threat actors belonging to the group tracked as UNC6240, or ShinyHunters, actively exploited the vulnerability as a zero-day between May 27 and June 9, initially targeting universities. A subsequent larger wave in September expanded across technology, IT services, healthcare, agriculture, transport, and government sectors globally. CISA added the identifier to its Known Exploited Vulnerabilities catalog with a mandated federal remediation date of June 15.

The affected versions are:

Assessing Exposure and Environment Vulnerability

Security teams need to inventory their enterprise architecture to identify any active deployments of PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Because the underlying design trusts the local loopback address by default, standard network perimeters and external firewalls do not mitigate the risk if internal components face exposure. Attackers have demonstrated the ability to bypass path-based web application firewall rules by using simple URL encoding techniques, such as requesting alternate character representations for administrative paths.

Verifying asset inventories against deployment logs helps determine whether systems process traffic destined for vulnerable integration and management interfaces. Organizations utilizing these database and enterprise resource planning systems should evaluate their internet exposure immediately to prevent full server takeovers.

The core components involved in the exploit path are:

Immediate Mitigation and Remediation Steps

Applying Oracle's security alert fix for CVE-2026-35273 remains the primary mandatory action for all system administrators. Administrators must maintain supported PeopleTools releases while ensuring compliance with security baselines. Relying solely on path-based web application firewall rules provides insufficient protection against sophisticated encoding bypasses.

In scenarios where immediate patching is not feasible, operational workarounds must be deployed to disable vulnerable administrative endpoints. Organizations can remove the Environment Management Hub application in single server setups or disable the service entirely in multi-server architectures without disrupting normal user sessions. For comprehensive assistance, our cyber security services team can evaluate exposure and reinforce system configurations.

The required remediation actions include:

Incident Triage and Post-Exploitation Response

Organizations that may have experienced unauthorized access before applying patches must execute rigorous forensics triage. Merely applying the software patch closes the entry vector but does not evict an attacker who has already established persistence inside the network. Mandiant guidance dictates that any host exhibiting web shell artifacts must be treated as fully compromised.

Defenders need to preserve forensic evidence, hunt for anomalous XML file creations or modified application directories, and immediately rotate every credential reachable from the PeopleSoft tier. Because ShinyHunters frequently combines data theft with extortion demands, affected businesses should prepare for potential extortion attempts and engage incident response services if compromise is confirmed.

Mandatory steps for potential compromises are:

Risk Implications for Small and Mid-Size Businesses

Small and mid-size enterprises often underestimate their exposure to enterprise-grade software vulnerabilities, assuming attackers focus solely on large conglomerates. The widespread nature of the September campaign demonstrates that educational institutions, regional technology providers, healthcare entities, and transport companies face active targeting. Critical vulnerabilities with CVSS scores of 9.8 allow unauthenticated attackers to achieve complete infrastructure takeovers over the network.

SMB leaders must prioritize patch management schedules and rely on verified vendor instructions rather than assuming perimeter defenses block internal trust vulnerabilities. Reviewing operational dependencies ensures that administrative hubs are properly isolated or disabled when updates are delayed. For organizations scaling their defenses, partnering with managed IT services providers ensures timely vulnerability identification and mitigation.

Key operational impacts for businesses include:

Sources