Oracle PeopleSoft PeopleTools flaw CVE-2026-35273 is three chained bugs

The Oracle PeopleSoft PeopleTools vulnerability CVE-2026-35273, exploited by the ShinyHunters group, is not a single bug but three flaws chained together, according to The Hacker News, which relays analysis from the Zero Day Initiative (ZDI). The flaw is in CISA’s Known Exploited Vulnerabilities (KEV) catalog, rated CVSS 9.8, and lets an unauthenticated attacker take over a server over the network. Oracle shipped a fix in June, so the urgent job is confirming it is applied and checking for earlier compromise.

What happened

ZDI’s Bobby Gould says his team reported three distinct vulnerabilities across two PeopleSoft components to Oracle. Oracle patched all of them under the single identifier CVE-2026-35273 in an out-of-band security alert on June 10. ZDI says it is working with Oracle to assign a separate CVE to each flaw. As of this week, the June identifier is still the only one on the record.

The chain starts with a server-side request forgery (SSRF, where a server is tricked into sending requests on an attacker’s behalf) in the Integration Gateway component. The attacker controls both the destination and the full payload, and the handler does not check that the destination is legitimate.

The second piece is a trust problem. The Environment Management Hub, an internal admin interface, decides whom to trust using a file named allowedhosts.properties, which ships with the local loopback address already listed. Pointing the SSRF at loopback makes the request look local, so the check passes and the internal interface becomes reachable from outside. From there, ZDI describes routes to remote code execution without a login. One abuses a log-writing command where the caller controls file contents and path, which allows a web shell to be written to disk.

Am I affected?

NVD lists these versions as affected:

• Oracle PeopleSoft Enterprise PeopleTools 8.61
• Oracle PeopleSoft Enterprise PeopleTools 8.62

NVD lists no fixed version number; see Oracle’s security alert for patch levels. Oracle’s alert for this issue is linked in the sources below; use it to confirm the patch level of every PeopleTools instance.

Technical details

• Weakness: CWE-306, missing authentication for a critical function.
• Attack vector: network over HTTP, no privileges and no user interaction (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
• KEV: added on 2026-06-12 with a due date of 2026-06-15 for US federal agencies. CISA lists known ransomware campaign use as "Known".
• EPSS: 0.96678, a very high modelled probability of exploitation activity.

Exploitation timeline

Mandiant and Google Threat Intelligence Group attribute a campaign to UNC6240, better known as ShinyHunters, that exploited the flaw between May 27 and June 9, mostly against universities. That was before Oracle’s June 10 advisory, so it was a zero-day throughout. A September follow-up from Mandiant described a renewed, larger wave spreading to technology, IT services, healthcare, agriculture, transport and government, affecting dozens of systems worldwide.

Why this matters

This section is our analysis, not new reporting. PeopleSoft often holds student, HR and finance data, and the gateway component is built to talk to outside systems, so it is frequently reachable from beyond the internal network. Anyone who patched only after mid-June, or who has not verified the patch, may have been exposed during the zero-day window and the later wave. A patch does not remove a web shell that was planted earlier. Treat any internet-facing instance that was unpatched in that period as a possible incident, not just a patching task.

Detection and hunting ideas

These follow from the described attack path rather than from published indicators, since no indicators of compromise were included in the reporting:

• Review gateway and web server logs for requests to the Integration Gateway listening connector that carry unexpected destination addresses, especially loopback.
• Look for new or modified files in web-served PeopleSoft directories, particularly script files created by the application account.
• Check allowedhosts.properties and compare it with your baseline.
• Look for child processes spawned by the PeopleSoft web server that you would not expect.

What to do

1. Inventory every PeopleTools instance and confirm whether it runs 8.61 or 8.62.
2. Verify that Oracle’s June security alert fix is installed on each one. Because this is in CISA KEV with known ransomware use, treat an unpatched internet-facing instance as an emergency, with patching within hours.
3. Remove internet exposure of the Integration Gateway and the Environment Management Hub wherever business needs allow, and restrict them by network controls.
4. Hunt for web shells and unexpected configuration changes covering at least May 27 onward, and preserve logs before cleaning up.
5. If you find signs of compromise, rotate credentials stored in or reachable from PeopleSoft and notify your incident response team and any affected data owners.
6. Watch for the separate CVE identifiers ZDI expects Oracle to assign, and update your tracking when they appear.

Rely on the Oracle alert for exact patch levels.

Related coverage

• SonicWall SMA 1000 SSRF flaw exploited after patch (CVE-2026-102255)
• Oracle Health Cerner breach reportedly nears 20 million people

Sources

• NVD: CVE-2026-35273
• Oracle Security Alert for CVE-2026-35273
• CISA Known Exploited Vulnerabilities catalog entry
• The Hacker News: ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws