ShinyHunters Keeps Exploiting Oracle PeopleSoft Flaw, Now Shown to Be Three Chained Bugs

What happened

Mandiant and Google Threat Intelligence Group say they identified renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by UNC6240, which they identify as ShinyHunters. They say the group exploited it as a zero-day (a flaw attacked before a fix existed) in June, mostly against academic institutions, and has since widened its targeting across multiple sectors and countries. ^[1]

The Hacker News reports the flaw is actually three bugs chained together, according to the researchers who reported it. Oracle patched all three under the single identifier CVE-2026-35273 in June. The root is a server-side request forgery, a trick that makes a server send requests on the attacker's behalf, which reaches an internal management interface because PeopleSoft trusts its own loopback address. ^[2]

Exploitation

Mandiant says the new wave stems from the group modifying its exploit to bypass web application firewall rules that blocked the vulnerable Environment Management Hub component. CISA lists the flaw in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, with known ransomware use marked as known. NVD rates it 9.8. ^[1]

Trend's Zero Day Initiative says it reported the issue to Oracle on June 10, 2026, and that it reported three distinct vulnerabilities across multiple PeopleSoft components. It says it is coordinating with Oracle to assign separate CVE identifiers for each. ^[3]

What is not yet known

The sources reviewed do not say how many organizations have been compromised or which sectors beyond education have been hit. Oracle's security alert for the flaw is the vendor reference for the fix. ^[1][3]