Summary
The critical Oracle PeopleSoft bug that ShinyHunters (tracked by Mandiant and GTIG as UNC6240) has exploited since May is not one flaw but three chained together, according to the researchers who reported it. Oracle patched all three under a single identifier, CVE-2026-35273 (CVSS 9.8), in June.
Bobby Gould of the Zero Day Initiative (ZDI) reported the flaws. ZDI is working with Oracle to assign separate CVEs, but CVE-2026-35273 is the only one on record so far.
The Exploit Chain
- SSRF in the Integration Gateway (PSIGW) lets an unauthenticated attacker send forged requests from the server.
- The forged request reaches the Environment Management Hub (PSEMHUB), which trusts
127.0.0.1by default, so the trust check passes. - The attacker achieves code execution by writing a web shell or planting a malicious XML file that is read through Java's
XMLDecoder.
| Field | Detail |
|---|---|
| CVE | CVE-2026-35273 |
| Affected | PeopleSoft Enterprise PeopleTools 8.61 and 8.62 |
| Status | Listed in CISA KEV |
Exploitation Timeline
- May 27 to June 9: attacks mostly against universities
- June 10: Oracle issues an out-of-band security alert with a fix
- September: a Mandiant follow-up describes a larger wave across many sectors, including government and healthcare, with attackers bypassing WAF rules by URL-encoding a character in the path
Recommendations
- Apply Oracle's patch and stay on a supported PeopleTools release.
- If patching is delayed, disable the EM Hub service (multi-server) or remove the PSEMHUB application (single-server), per Oracle's guidance.
- Do not rely on path-based WAF blocking as a substitute for patching.
- If compromise is suspected, treat hosts with web shells as compromised, preserve evidence, and rotate credentials reachable from the PeopleSoft tier.
Sources do not confirm whether patching removes access an attacker already obtained, so assume prior exposure warrants a hunt.