In a recent revelation, cybersecurity researchers uncovered that a critical vulnerability in Oracle PeopleSoft, previously thought to be a single flaw, is actually a combination of three interconnected weaknesses. The cybercriminal group known as ShinyHunters exploited these vulnerabilities starting in May, according to experts.
Details of the Vulnerability
The vulnerabilities, identified under the collective CVE-2026-35273, were addressed by Oracle in June through a comprehensive patch. Initially, the flaw was believed to be a server-side request forgery (SSRF) that allowed unauthorized access to internal management interfaces by exploiting PeopleSoft’s default trust in its loopback address. This loophole enabled attackers to execute remote code without needing to log in.
The Zero Day Initiative (ZDI) was instrumental in reporting the flaw to Oracle, revealing that the vulnerability spans two distinct PeopleSoft components. ZDI is currently collaborating with Oracle to assign individual CVEs to each flaw, but as of now, CVE-2026-35273 remains the sole identifier.
Impact and Exploitation
The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, with a high severity score of 9.8. It allows attackers to gain complete control over the affected server through the network. Oracle released a fix via an urgent security alert on June 10. Notably, this flaw is listed in the CISA’s Known Exploited Vulnerabilities catalog.
ShinyHunters began exploiting this vulnerability prior to Oracle’s patch release. Reports from Mandiant and Google Threat Intelligence Group (GTIG) attribute a series of attacks to ShinyHunters, targeting primarily academic institutions between May 27 and June 9. The attacks expanded in September, affecting sectors like technology, healthcare, and government worldwide.
Technical Breakdown and Mitigation
The analysis by ZDI explains that the SSRF flaw within the Integration Gateway (PSIGW) component forwards requests to any address, bypassing legitimacy checks. This allows attackers to reach the Environment Management Hub (PSEMHUB), which trusts requests from the loopback address by default, thereby breaching its intended security.
ZDI described two exploitation methods: inserting a web shell through controlled log entries or using a malicious XML file that executes upon service restart. These techniques highlight the vulnerability’s design flaw, where default loopback access undermines the system’s trust checks.
ShinyHunters further circumvented defenses by manipulating web application firewall (WAF) rules to access restricted paths. Oracle and Mandiant emphasize the necessity of applying the patch and advise disabling or removing the PSEMHUB service in certain configurations to mitigate risks.
For systems potentially compromised, immediate action is recommended. Mandiant suggests treating affected hosts as compromised, preserving forensic evidence, and rotating credentials to mitigate further damage. The patch serves to close the vulnerability but does not remove any access already gained by attackers.
