The critical Oracle PeopleSoft vulnerability exploited by the ShinyHunters hacking group involves three interconnected security flaws rather than a single bug, according to a detailed technical analysis published by TrendAI’s Zero Day Initiative (ZDI) on October 27, 2026.
The flaws can be chained to bypass internal access controls and execute code remotely without authentication, potentially giving attackers control over vulnerable enterprise servers.
Oracle patched the vulnerabilities under a single identifier, CVE-2026-35273, through an emergency security alert released on June 10. ZDI researcher Bobby Gould said the team reported three distinct vulnerabilities affecting two PeopleSoft components and is working with Oracle to assign separate CVE identifiers to each. The three issues remain publicly associated with the original identifier in Oracle’s advisory. The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 and carries a CVSS score of 9.8 out of 10. It is also listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.
According to ZDI’s technical analysis, the attack chain involves the PeopleSoft Integration Gateway (PSIGW), which exchanges messages with external systems, and the Environment Management Hub (PSEMHUB), an administrative interface designed to accept requests only from trusted hosts.
The first flaw is a server-side request forgery (SSRF) vulnerability in PSIGW. It allows an attacker to control the destination of a forwarded request and the payload sent to that destination without adequate validation. This can expose internal services that should not be directly reachable from the internet.
The second weakness lies in how PSEMHUB determines whether incoming requests are trusted. Its configuration file, allowedhosts.properties, includes the local loopback address, 127.0.0.1, by default. Attackers can exploit the SSRF flaw to send requests to that address, making the traffic appear to originate from the server itself and bypassing the intended access restrictions.
Once inside the administrative interface, attackers can use two different methods to execute code. One abuses a logging command that allows control over the contents and destination path of a file. This can enable an attacker to place a web shell in the application directory and run commands under the PeopleSoft service account.
The second method involves creating a malicious XML file that is processed by Java’s XMLDecoder when the service starts. This can trigger code execution without requiring a web shell, potentially making the compromise harder to identify through routine web shell detection.
The vulnerabilities were already being exploited before Oracle released its fix. Google Threat Intelligence Group and Mandiant attributed attacks between May 27 and June 9 to UNC6240, the group known as ShinyHunters. The initial campaign primarily targeted universities, making this a zero-day attack during the period before Oracle’s June 10 advisory.
The threat continued after the patch became available. In a September 25 report, Mandiant and Google Threat Intelligence Group documented a renewed mass-exploitation campaign that expanded beyond universities to technology companies, IT service providers, healthcare organizations, agricultural businesses, transportation operators, and government entities. The researchers reported web shell deployment on dozens of systems worldwide.
The September campaign also revealed how attackers adapted to security measures introduced after the initial attacks. Some organizations had deployed web application firewall (WAF) rules to block requests to the vulnerable PSEMHUB endpoint without installing Oracle’s security patch. ShinyHunters bypassed certain string-based rules by URL-encoding a single character in the request path, using /%50SEMHUB/ instead of /PSEMHUB/. The server decoded the request and routed it to the vulnerable application, allowing the attack to proceed despite the apparent restriction.
Mandiant also documented post-exploitation activity involving web shells and remote management tools. On Linux systems, the attackers used MeshAgent, a legitimate remote management tool associated with the MeshCentral platform, to maintain access to compromised machines. Investigators also observed tunneling tools and additional malicious components used to support continued access and movement within victim environments. These findings show that exploitation can lead to a broader intrusion rather than stopping at remote code execution.
Oracle recommends that affected organizations immediately apply the security fix for CVE-2026-35273 and remain on supported PeopleTools versions. Its June advisory also recommends disabling the Environment Management Hub service in multi-server deployments or removing the PSEMHUB application in single-server deployments when immediate patching is not possible. Firewall rules and endpoint blocking should be treated as supplementary protections, not substitutes for the patch.
Organizations should also investigate whether their PeopleSoft systems were compromised before remediation. Mandiant recommends reviewing web server access logs for requests to /PSEMHUB/ and URL-encoded variants such as /%50SEMHUB/, especially suspicious POST requests and unexpected requests for JSP files. Administrators should inspect application directories for unauthorized files, investigate unexpected remote management agents and outbound connections, preserve forensic evidence, and rotate credentials accessible from the PeopleSoft environment.
The distinction between patching and incident response is particularly important in this case. Installing the fix can prevent exploitation of the known vulnerability, but it does not establish that an attacker who previously gained access has been removed. Organizations exposed during the attack window should therefore investigate for persistence, unauthorized accounts, credential theft, and data exfiltration.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
ShinyHunters is known for stealing sensitive information and demanding payment from victims. For organizations running PeopleSoft, the latest findings underscore the need to combine immediate patching with a thorough compromise assessment, particularly if the systems were exposed to the internet during the May, June, or September exploitation campaigns.
