Oracle PeopleSoft flaw chain enabled ShinyHunters attacks

Oracle's critical PeopleSoft issue tracked as CVE-2026-35273 is a chain of three vulnerabilities, not a single defect, the Zero Day Initiative (ZDI) has disclosed. The vulnerability affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62, has a CVSS score of 9.8, and can allow an unauthenticated network attacker to take over a server.

Oracle issued an out-of-band fix on June 10 under the one CVE identifier. Mandiant and Google Threat Intelligence Group attribute exploitation from May 27 through June 9 to UNC6240, the cluster also known as ShinyHunters. Because the activity predated Oracle's advisory, the attackers were using a zero-day.

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Mandiant later reported a larger September campaign that expanded beyond universities into technology, IT services, healthcare, agriculture, transport and government, affecting dozens of systems worldwide.

How the PeopleSoft chain reaches code execution

ZDI reported three distinct issues spanning two separate PeopleSoft web applications: the Integration Gateway, or PSIGW, and the Environment Management Hub, or PSEMHUB. PSIGW handles exchanges with external systems, while PSEMHUB is an administrative interface intended to respond only to trusted hosts.

The first issue is a server-side request forgery in PSIGW. An attacker can control the destination address and payload forwarded through its listening connector, without validation that the target is legitimate. That capability becomes critical because it can be directed at services that should not be exposed externally.

PSEMHUB relies on an allowlist in allowedhosts.properties. The default list includes the loopback address, 127.0.0.1. By aiming the SSRF request at that address, an outside attacker can make the request appear to come from the PeopleSoft host itself and pass the interface's trust check.

Two paths after the trust check

Once the internal interface is reachable, ZDI described two routes to code execution. One abuses a PSEMHUB logging command that permits control of both file contents and the destination path. An attacker can write a web shell into the application directory and execute commands under the PeopleSoft service account.

The other route writes a malicious XML file that PSEMHUB processes with Java's XMLDecoder when the service restarts. That can execute attacker-controlled code without deploying a web shell, leaving less for conventional web-shell detection to identify.

The default trust in loopback access is central to the chain: it makes the PSEMHUB check ineffective when PSIGW can be used to relay a request locally. It also explains why network restrictions alone may not provide the protection defenders expect.

Patch first and investigate suspected compromise

Mandiant observed attackers evading some web application firewall rules that blocked the plain-text /PSEMHUB/ path. Requests using /%50SEMHUB/ could evade rules that did not account for URL decoding, while the PeopleSoft server decoded the path and served the interface. Mandiant states that path-based WAF blocking is not a substitute for patching.

Organizations should install Oracle's security alert fix for CVE-2026-35273 and remain on a supported PeopleTools release. Where immediate patching is not possible, Oracle advises disabling the Environment Management Hub in multi-server deployments or removing the PSEMHUB application in single-server installations; the guidance says these actions do not interrupt normal user sessions.

Any PeopleSoft host found with a web shell should be treated as compromised. Preserve evidence, hunt for malicious artifacts and rotate every credential reachable from the PeopleSoft tier. Patching closes the exposed route, but businesses should pair it with compromise assessment and credential recovery where intrusion indicators are present.