ShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273
Original title: CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.
Mandiant reported continued mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by ShinyHunters. TrendAI's Zero Day Initiative, which reported the issue on June 10, says Oracle patched three distinct bugs under that single CVE. A server-side request forgery in the Integration Gateway can reach Environment Management Hub functions that trust localhost, and a file-path flaw can then write attacker-controlled content for remote code execution. Oracle has issued a patch while separate CVE assignments are still being coordinated.
Unconfirmed: Separate CVE identifiers for the three reported bugs have not yet been assigned.
- ZDI reported the issues to Oracle on June 10, 2026.
- The bugs span PSIGW and PSEMHUB and were patched under one CVE.
- Default allowed hosts include localhost, which the SSRF can satisfy.
- ZDI is coordinating with Oracle to assign separate CVEs.
Impact: Server-side request forgery leading to remote code execution
| Product | Affected |
|---|---|
| Oracle PeopleSoft | — |
- 1.Apply Oracle's patch for CVE-2026-35273.
- CVEs
- CVE-2026-35273
- Vendors
- Oracle
- Threat actors
- ShinyHunters
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
5 min read at thezdi.com
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research.
By Bobby Gould · thezdi.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.