Oracle PeopleSoft zero-day exploited by ShinyHunters turns out to be three chained flaws

The critical Oracle PeopleSoft vulnerability that the ShinyHunters group has been exploiting since May is actually three bugs chained together, according to the researchers who discovered it. Oracle fixed all three in June under a single identifier, CVE-2026-35273.

The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the issue to Oracle. ZDI says it found three distinct vulnerabilities in two PeopleSoft components and is working with Oracle to assign each its own CVE. For now, the June identifier is the only one on record.

Scope of the problem

CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62 and carries a CVSS score of 9.8. It lets an unauthenticated attacker take over the server over the network. Oracle shipped a fix on June 10 in an out-of-band security alert, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog.

According to Mandiant and Google Threat Intelligence Group, UNC6240, better known as ShinyHunters, exploited the bug between May 27 and June 9, mostly against universities. Since all of that happened before the fix, the flaw was a zero-day throughout. In September, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport and government, affecting dozens of systems worldwide.

How the chain works

Two components, each running as a separate web application, are involved. The Integration Gateway (PSIGW) exchanges messages with outside systems. The Environment Management Hub (PSEMHUB) is an internal admin interface meant to answer only to trusted hosts.

The first flaw is a server-side request forgery (SSRF) in PSIGW. An attacker controls both the address a request is forwarded to and its full payload, and nothing checks the destination. On its own that would matter little, were it not for what it can reach.

PSEMHUB checks callers against a list in a file called allowedhosts.properties, which ships with 127.0.0.1 already included. The attacker aims the SSRF at the loopback address, the request appears to come from the machine itself, and the trust check passes. The interface Oracle meant to wall off becomes reachable from outside.

From there, ZDI describes two routes to code execution. The first abuses a PSEMHUB logging command: the caller sets both the file contents and the path, so an attacker can drop a web shell into the application directory and run commands as the PeopleSoft service account. The second writes a malicious XML file that PSEMHUB reads via Java's XMLDecoder on the next service start. This route needs no web shell and leaves less for standard detection to catch.

In the September wave, Mandiant saw ShinyHunters bypass WAF rules blocking the /PSEMHUB/ path by URL-encoding a single character and requesting /%50SEMHUB/. Many rules match the path as plain text, while the PeopleSoft server decodes it and serves the page.

What to do

The main step is to install Oracle's fix and stay on a supported PeopleTools release. Mandiant stresses that path-based WAF blocking is no substitute for patching. If patching isn't possible yet, Oracle advises disabling the Environment Management Hub service in multi-server setups or removing the PSEMHUB application in single-server ones. Normal user sessions are unaffected.

If a breach may already have happened, Mandiant recommends treating any host with a web shell as compromised, preserving evidence and rotating every credential reachable from the PeopleSoft tier. ShinyHunters steal data and then demand payment, so organizations should prepare for extortion. The sources don't say whether patching removes access an attacker already has, and Mandiant's guidance assumes it doesn't: the patch closes the door but doesn't evict anyone already inside.

Source: The Hacker News