Skip to content
OriginalSign in

CISACISA

CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog

Part of the CVE-2026-35273 story · since 11 Jun

Developinglatest 2 hours ago29 articles12 outlets
11 Jun · SecurityOnline first21 Aug14 Sep8 OctNowThis article10th of 29
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV. This article, 10th of 29.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.

CISA has added one new vulnerability, CVE-2026-35273, related to Oracle PeopleSoft Enterprise, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability is considered a significant risk for federal enterprises. The Binding Operational Directive (BOD) 26-04 emphasizes the need for federal agencies to prioritize remediation of high-risk vulnerabilities, particularly those in the KEV catalog.

While BOD 26-04 applies only to Federal Civilian Executive Branch agencies, CISA recommends all organizations adopt similar risk-based vulnerability management practices. Organizations aware of vulnerabilities not listed in the KEV catalog are encouraged to submit nominations.

How the story developed

All 29 articles
Developinglatest 2 hours ago29 articles12 outlets

29 articles from 12 outlets since 11 Jun. Picked up again today after 3 weeks quiet. This was the 10th report, 2 days after the first.

Now11 Jun22 Sep2725811141721First reportSecurityOnline · 11 Jun, 06:32This article10th of 29 · day 1
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV. This article, 10th of 29.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Thu 11 JunDay 04
    1. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-3527306:32 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw14:06 · SecurityWeek · Known exploited CVE
    3. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw20:47 · Google Cloud · Known exploited CVE
    4. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities21:20 · The Hacker News · Known exploited CVE
  2. Fri 12 JunDay 110
    1. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-3527303:01 · SecurityOnline · Known exploited CVE
    2. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham06:50 · SecurityWeek · Known exploited CVE
    3. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog19:20 · CISA · official · CISA alert · Known exploited CVE · This article, 10th of 29
    Show 7 more from 12 Jun
    1. CVE-2026-35273 flaw used in ShinyHunters attack on universities11:29 · Security Affairs · Known exploited CVE
    2. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)14:21 · Rapid7 · Known exploited CVE
    3. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide16:31 · DataBreaches · Known exploited CVE
    4. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis19:50 · Ars Technica · Known exploited CVE
    5. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 1520:42 · CISA · official · Known exploited CVE
    6. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed21:01 · Dark Reading · Known exploited CVE
    7. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog21:44 · CISA · official · Known exploited CVE
  3. Sat 13 JunDay 21
    1. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-3527309:51 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 15 JunDay 44
    1. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass02:10 · SecurityOnline · Known exploited CVE
    2. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft02:10 · SecurityOnline · Known exploited CVE
    3. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits04:01 · SecurityOnline · Known exploited CVE
    4. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-3527305:07 · SecurityOnline · Known exploited CVE

  5. Quiet for 14 weeks

    Wed 23 SepDay 1042
    1. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data07:36 · SecurityWeek · Picked up again · Known exploited CVE
    2. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw14:38 · Security Affairs · Known exploited CVE

  6. Quiet for 3 days

    Sat 26 SepDay 1071
    1. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign07:14 · Google Cloud · Picked up again · Known exploited CVE

  7. Quiet for 2 days

    Mon 28 SepDay 1092
    1. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass11:30 · SecurityWeek · Picked up again · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches15:30 · Krebs on Security · Known exploited CVE
  8. Tue 29 SepDay 1102
    1. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam10:22 · The Hacker News · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe11:30 · SecurityWeek · Known exploited CVE

  9. Quiet for 7 days

    Tue 6 OctDay 1171
    1. FBI removes Accenture contractor after ShinyHunters breach exposes staff data07:46 · The Hacker News · Picked up again · Known exploited CVE
  10. Wed 7 OctDay 1181
    1. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt14:31 · Krebs on Security · Known exploited CVE

  11. Quiet for 3 weeks

    Tue 27 OctDay 1381
    1. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution19:05 · thezdi.com · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in