ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Original title: ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
Researchers at the Zero Day Initiative say the Oracle PeopleSoft bug ShinyHunters exploited from late May is three chained flaws, all patched in June under CVE-2026-35273. An SSRF in the Integration Gateway reaches the Environment Management Hub because loopback is trusted by default, enabling unauthenticated remote code execution. Mandiant and Google Threat Intelligence Group tie UNC6240, also known as ShinyHunters, to pre-patch attacks mostly on universities and a larger September wave across other sectors. The flaw is on CISA's Known Exploited Vulnerabilities catalog.
Unconfirmed: Separate CVEs are not yet assigned, and sources do not say whether patching removes access already gained.
- PeopleTools 8.61 and 8.62 are affected; CVSS is 9.8.
- Oracle's out-of-band fix was released on June 10.
- Exploitation ran from May 27 to June 9 before the advisory.
- A September wave hit dozens of systems beyond education.
- ZDI is still seeking a separate CVE for each flaw.
Impact: Unauthenticated remote code execution and server takeover
| Product | Affected |
|---|---|
| Oracle PeopleSoft Enterprise PeopleTools | 8.61 and 8.62 |
- 1.Install Oracle's security alert fix for CVE-2026-35273.
- 2.If unpatched, disable the Environment Management Hub or remove PSEMHUB.
- 3.Treat web-shell hosts as compromised, preserve evidence, and rotate reachable credentials.
- CVEs
- CVE-2026-35273
- Vendors
- Oracle
- Threat actors
- ShinyHuntersUNC6240
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
4 min read at thehackernews.com
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.