Skip to content
OriginalSign in

CISA

CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog

Part of the CVE-2026-35273 story · since 11 Jun

Developinglatest 2 hours ago29 articles12 outlets
11 Jun · SecurityOnline first21 Aug14 Sep8 OctNowThis article14th of 29
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV. This article, 14th of 29.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) Catalog, maintained by CISA, serves as an authoritative resource for vulnerabilities actively exploited in the wild, helping organizations manage risks and prioritize vulnerability management. A specific entry highlights CVE-2026-35273 affecting Oracle PeopleSoft Enterprise PeopleTools, which has a missing authentication vulnerability allowing unauthenticated exploitation.

Organizations are advised to implement mitigations per vendor guidance and follow CISA's direction on prioritizing security updates based on risk. Users can nominate new vulnerabilities for inclusion in the catalog and subscribe for updates.

How the story developed

All 29 articles
Developinglatest 2 hours ago29 articles12 outlets

29 articles from 12 outlets since 11 Jun. Picked up again today after 3 weeks quiet. This was the 14th report, 2 days after the first.

Now11 Jun22 Sep2725811141721First reportSecurityOnline · 11 Jun, 06:32This article14th of 29 · day 1
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV. This article, 14th of 29.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Thu 11 JunDay 04
    1. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-3527306:32 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw14:06 · SecurityWeek · Known exploited CVE
    3. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw20:47 · Google Cloud · Known exploited CVE
    4. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities21:20 · The Hacker News · Known exploited CVE
  2. Fri 12 JunDay 110
    1. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-3527303:01 · SecurityOnline · Known exploited CVE
    2. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog19:20 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog21:44 · CISA · official · Known exploited CVE · This article, 14th of 29
    Show 7 more from 12 Jun
    1. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham06:50 · SecurityWeek · Known exploited CVE
    2. CVE-2026-35273 flaw used in ShinyHunters attack on universities11:29 · Security Affairs · Known exploited CVE
    3. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)14:21 · Rapid7 · Known exploited CVE
    4. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide16:31 · DataBreaches · Known exploited CVE
    5. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis19:50 · Ars Technica · Known exploited CVE
    6. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 1520:42 · CISA · official · Known exploited CVE
    7. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed21:01 · Dark Reading · Known exploited CVE
  3. Sat 13 JunDay 21
    1. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-3527309:51 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 15 JunDay 44
    1. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass02:10 · SecurityOnline · Known exploited CVE
    2. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft02:10 · SecurityOnline · Known exploited CVE
    3. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits04:01 · SecurityOnline · Known exploited CVE
    4. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-3527305:07 · SecurityOnline · Known exploited CVE

  5. Quiet for 14 weeks

    Wed 23 SepDay 1042
    1. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data07:36 · SecurityWeek · Picked up again · Known exploited CVE
    2. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw14:38 · Security Affairs · Known exploited CVE

  6. Quiet for 3 days

    Sat 26 SepDay 1071
    1. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign07:14 · Google Cloud · Picked up again · Known exploited CVE

  7. Quiet for 2 days

    Mon 28 SepDay 1092
    1. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass11:30 · SecurityWeek · Picked up again · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches15:30 · Krebs on Security · Known exploited CVE
  8. Tue 29 SepDay 1102
    1. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam10:22 · The Hacker News · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe11:30 · SecurityWeek · Known exploited CVE

  9. Quiet for 7 days

    Tue 6 OctDay 1171
    1. FBI removes Accenture contractor after ShinyHunters breach exposes staff data07:46 · The Hacker News · Picked up again · Known exploited CVE
  10. Wed 7 OctDay 1181
    1. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt14:31 · Krebs on Security · Known exploited CVE

  11. Quiet for 3 weeks

    Tue 27 OctDay 1381
    1. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution19:05 · thezdi.com · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in