ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
82
Product
Environment Management Hub
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenSep 25, 2026
- Last mentioned14d ago
Timeline
4 articles · newest firstFBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The FBI removed an Accenture contractor after a missed PeopleSoft patch let ShinyHunters steal thousands of employees' data.
84
Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks
PeopleSoft customers lack vendor guidance as ShinyHunters claims a second zero-day after the confirmed FBI breach.
80
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules to plant web shells.
85
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
Appears with
- ShinyHuntersthreat actor · 4
- Oraclevendor · 4
- Mandiantorganization · 4
- PeopleSoftproduct · 3
- Oracleorganization · 2
- FBIvictim · 2
- FBIorganization · 2
- UNC6240threat actor · 2
- Google Threat Intelligence Grouporganization · 2
- PeopleSoft Enterprise PeopleToolsproduct · 1
- WebLogicproduct · 1
- Googlevendor · 1
- Zero Day Initiativeorganization · 1
- CISAorganization · 1
- Googleorganization · 1
- Accentureorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.