Skip to content
OriginalSign in

thezdi.comBobby Gould

ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution

Part of the CVE-2026-35273 story · since 11 Jun

Developinglatest 2 hours ago29 articles12 outlets
11 Jun · SecurityOnline first21 Aug14 Sep8 OctNowThis article29th of 29
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV. This article, 29th of 29.

Mandiant’s September 2026 report on CVE-2026-35273 documents continued mass exploitation of a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft, as reported by the TrendAI/Zero Day Initiative (ZDI) team led by Minh Giang and Lucas Miller. The disclosure splits the issue into three distinct vulnerabilities across multiple PeopleSoft components, with Oracle issuing a patch under a single CVE and the researchers aiming to have separate CVEs assigned for each flaw.

The group behind the exploitation is identified as ShinyHunters. The ZDI blog, published on 27 October 2026, outlines how the SSRF can be chained with other weaknesses to achieve remote code execution (RCE).

Bug 1, PSIGW Server-Side Request Forgery (ZDI-CAN-31816), describes how an attacker can send a POST to PSIGW/HttpListeningConnector, select the HttpTargetConnector, and direct the request to a loopback target (http://127.0.0[.]1:8000) that passes the validateClient check. The HttpTargetConnector handler accepts arbitrary data, enabling an attacker to forward a crafted request to the internal target without sufficient validation. The PSIGW SSRF thus serves as a foothold into the PeopleSoft stack.

Bug 2 (ZDI-CAN-31818) and Bug 3 (ZDI-CAN-31817) describe how an attacker can escalate from SSRF to RCE via External Control of File Path in ExecuteProcessActivityCommand, followed by deserialization of malicious XML in the PSEMHUB environment during initialization. The attack chain writes a web shell to the PSEMHUB WAR path, then causes the HubServlet to deserialise the attacker’s XML payload, triggering code execution under the PeopleSoft service account.

The analysis emphasises that localhost access is allowed by default, rendering validateClient ineffective when combined with the SSRF. The post notes that Oracle coordinated with researchers to attribute separate CVEs to each issue and that mitigation will require Oracle patches and adjusted access controls.

How the story developed

All 29 articles
Developinglatest 2 hours ago29 articles12 outlets

29 articles from 12 outlets since 11 Jun. Picked up again today after 3 weeks quiet. This was the 29th report, 139 days after the first.

Now11 Jun22 Sep2725811141721First reportSecurityOnline · 11 Jun, 06:32This article29th of 29 · day 138CISA alert12 Jun, 19:20 · official
  • Thu 11 Jun, 06:32 UTC. SecurityOnline, first report. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek, its first report on the story. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs, its first report on the story. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches, its first report on the story. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:20 UTC. CISA, its first report on the story. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica, its first report on the story. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 20:42 UTC. CISA. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading, its first report on the story. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:44 UTC. CISA. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 04:01 UTC. SecurityOnline. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 05:07 UTC. SecurityOnline. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-35273. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security, its first report on the story. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV. This article, 29th of 29.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Thu 11 JunDay 04
    1. Oracle warns of critical PeopleSoft RCE flaw CVE-2026-3527306:32 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw14:06 · SecurityWeek · Known exploited CVE
    3. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw20:47 · Google Cloud · Known exploited CVE
    4. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities21:20 · The Hacker News · Known exploited CVE
  2. Fri 12 JunDay 110
    1. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-3527303:01 · SecurityOnline · Known exploited CVE
    2. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham06:50 · SecurityWeek · Known exploited CVE
    3. CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog19:20 · CISA · official · CISA alert · Known exploited CVE
    Show 7 more from 12 Jun
    1. CVE-2026-35273 flaw used in ShinyHunters attack on universities11:29 · Security Affairs · Known exploited CVE
    2. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)14:21 · Rapid7 · Known exploited CVE
    3. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide16:31 · DataBreaches · Known exploited CVE
    4. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis19:50 · Ars Technica · Known exploited CVE
    5. CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 1520:42 · CISA · official · Known exploited CVE
    6. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed21:01 · Dark Reading · Known exploited CVE
    7. CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog21:44 · CISA · official · Known exploited CVE
  3. Sat 13 JunDay 21
    1. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-3527309:51 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 15 JunDay 44
    1. UEFI shim bug CVE-2026-35273 enables Secure Boot bypass02:10 · SecurityOnline · Known exploited CVE
    2. CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft02:10 · SecurityOnline · Known exploited CVE
    3. Codex Rate Limit Reset: OpenAI Introduces Flexible Limits04:01 · SecurityOnline · Known exploited CVE
    4. Oracle PeopleSoft flaw lets attackers bypass auth, CVE-2026-3527305:07 · SecurityOnline · Known exploited CVE

  5. Quiet for 14 weeks

    Wed 23 SepDay 1042
    1. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data07:36 · SecurityWeek · Picked up again · Known exploited CVE
    2. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw14:38 · Security Affairs · Known exploited CVE

  6. Quiet for 3 days

    Sat 26 SepDay 1071
    1. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign07:14 · Google Cloud · Picked up again · Known exploited CVE

  7. Quiet for 2 days

    Mon 28 SepDay 1092
    1. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass11:30 · SecurityWeek · Picked up again · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches15:30 · Krebs on Security · Known exploited CVE
  8. Tue 29 SepDay 1102
    1. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam10:22 · The Hacker News · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe11:30 · SecurityWeek · Known exploited CVE

  9. Quiet for 7 days

    Tue 6 OctDay 1171
    1. FBI removes Accenture contractor after ShinyHunters breach exposes staff data07:46 · The Hacker News · Picked up again · Known exploited CVE
  10. Wed 7 OctDay 1181
    1. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt14:31 · Krebs on Security · Known exploited CVE

  11. Quiet for 3 weeks

    Tue 27 OctDay 1381
    1. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution19:05 · thezdi.com · Picked up again · Known exploited CVE · This article, 29th of 29

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in