Nissan Discloses Employee Data Breach Linked to Oracle Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools CVE-2026-35273 is a missing-authentication flaw (CWE-306) in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported releases 8.61 and 8.62. An unauthenticated attacker with network access over HTTP can reach the vulnerable component with no credentials and no user interaction, and successful attacks result in full takeover of the PeopleTools environment — reported in the wild as remote code execution followed by data theft. Organizations running PeopleSoft — including universities, government agencies and large enterprises — are affected, and the ShinyHunters group has already used the flaw against unpatched universities, with Nissan disclosing an employee-data breach linked to it. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-12 with ransomware use noted, and EPSS assigns a 95.5% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but exploitation is confirmed in the wild, having been used as a zero-day before patching. Do: Apply the PeopleTools security fixes for releases 8.61 and 8.62 per Oracle's advisory instructions immediately, prioritizing internet-facing instances to meet CISA KEV/BOD 26-04 timelines; where patching is not yet possible, restrict HTTP access to the PeopleSoft tier from untrusted networks. Review web and application logs on 8.61/8.62 environments for signs of unauthenticated access to the Updates Environment Management component, given confirmed ShinyHunters exploitation and ransomware use. Organizations unable to mitigate internet exposure should follow BOD 26-04 guidance for cloud services or consider discontinuing use of the exposed product. | 9.8 | 95% | KEV ransomware |
| largetens of thousands of PeopleTools environments across thousands of organizations (only a subset internet-exposed); exact counts unknown |
Full article389 words · extracted from infosecurity-magazine.com · click to collapse
Nissan has disclosed that current and former employees may have had sensitive personal data stolen, including Social Security numbers, banking details and tax records, after attackers exploited a zero-day flaw in Oracle's PeopleSoft software.
The carmaker said in a breach notification published on June 26 that Oracle had warned it of a cyber event affecting hundreds of companies, and that Nissan was specifically targeted.
It believes the breach affected current and former staff in the US, Canada, Mexico and Brazil and exposed data, including national identification numbers and dependent or beneficiary information.
Caught in a Mass PeopleSoft Campaign
Nissan described the entry point only as an unknown vulnerability in Oracle PeopleSoft, the enterprise software it uses to run payroll and HR.
The flaw, tracked as CVE-2026-35273, is a critical remote code execution bug that attackers exploited as a zero-day. The wider campaign has been linked to the ShinyHunters extortion group, which claimed to have hit more than 100 organizations, mostly universities.
Oracle issued an out-of-band advisory and mitigations only after the attacks began. Nissan's filing put the breach on May 27 and June 9, the window in which the campaign ran. Most named victims so far have been universities, making Nissan one of the larger corporate names caught in it.
Sensitive Data and a Payroll Lockdown
Beyond Social Security and national identification numbers, Nissan said the exposed information could include contact and banking details, financial and tax data plus dependent or beneficiary records. The company said it had secured its systems, was working with Oracle and would offer affected staff free credit or dark web monitoring where available.
As a precaution, Nissan has restricted payroll access so that staff must use a network computer or secured VPN to view pay slips or change direct deposit details, and it is adding extra identity checks before processing payroll requests. It urged employees to watch for phishing, change reused passwords and enable multi-factor authentication (MFA).
Simon Pamplin, CTO at data security firm Certes, called it "a mass-casualty event across hundreds of unrelated organizations," warning that patching the flaw does nothing for data already taken during the exploitation window.
Nissan said its investigation was ongoing and that affected individuals would be contacted directly.
Image credit: Luthfi Syahwal / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/nissan-oracle-peoplesoft-zero-day/