Skip to content
securitytabs

LiveUpdated

Oracle PeopleSoft flaw exploited by ShinyHunters is three chained bugs, researchers say

A flaw in Oracle's PeopleSoft business software has been used in mass attacks by the ShinyHunters group, and researchers now say it is actually three bugs chained together. Organizations running PeopleSoft should confirm that Oracle's patch is installed.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Mandiant and Google Threat Intelligence Group say they have identified renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by UNC6240, the group also known as ShinyHunters, with expanded targeting across multiple sectors worldwide. They say the actor exploited the flaw as a zero-day (a flaw exploited before a fix existed), mainly against academic institutions, in June. [1]

Google says the new wave stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules that blocked the vulnerable component. [1]

Three flaws under one identifier

Researchers at TrendAI's Zero Day Initiative say they first reported the issue to Oracle on June 10, 2026, and that they found three distinct vulnerabilities across multiple PeopleSoft components. Oracle patched them under a single identifier, CVE-2026-35273, and the researchers say they are coordinating with Oracle to assign separate CVEs to each. [2]

The Hacker News reports the root is a server-side request forgery (a flaw that makes a server send requests on an attacker's behalf) that reaches an internal management interface because PeopleSoft trusts its own loopback address. It says ShinyHunters has exploited the bug since May. The Zero Day Initiative's write-up is titled as a path from that request forgery to remote code execution. [3][2]

Severity and CISA listing

NVD rates CVE-2026-35273 9.8 on the CVSS scale, and its EPSS exploitation-probability score is 0.967 as of October 27. CISA lists it in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, and marks known ransomware use as Known. [1]

What is not yet known

The sources reviewed do not list the new identifiers expected for the two additional flaws or detailed mitigations beyond Oracle's patch. Oracle's own security alert is the reference for fixed versions. [2][3]

Timeline

  1. The Hacker News reported the zero-day is three chained flaws. [3]

  2. The Zero Day Initiative published its technical analysis of the chained flaws. [2]

  3. Mandiant and Google Threat Intelligence reported renewed mass exploitation by ShinyHunters. [1]

  4. · CISA KEV

    CISA added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog.

  5. The Zero Day Initiative's researchers reported the flaws to Oracle. [2]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small organizations rarely run PeopleSoft directly, but a provider or school system they depend on might. Google reports ShinyHunters has targeted many sectors, and Oracle has released a patch. [1][3]

What to do

  1. Ask any provider that hosts PeopleSoft for you whether Oracle's patch for this flaw is installed. [3]
  2. Install Oracle's update if you run PeopleSoft yourself. [3]

Mid-size company

A small IT or security team

What to know

Google says the attackers changed their exploit to get around firewall rules, so a WAF rule alone may not be enough. Oracle patched all three flaws under one identifier in June. [1][3]

What to do

  1. Confirm that PeopleSoft systems have Oracle's patch for CVE-2026-35273 applied. [3][2]
  2. Review Oracle's security alert for the flaw and the Mandiant report for details on the exploitation. [1]

Large enterprise

A security operations team

What to know

CISA lists the flaw as exploited, and Google reports renewed mass exploitation across sectors after the actor adapted its exploit to bypass firewall rules. The researchers say three separate bugs were fixed under the one CVE. [1][2]

What to do

  1. Verify Oracle's patch is in place on every PeopleSoft instance, including internet-facing ones. [3]
  2. Use the Mandiant report on UNC6240 activity to guide threat hunting on PeopleSoft servers. [1]
  3. Watch for the separate CVEs the researchers say Oracle is expected to assign. [2]

Sources

  1. [1]Google Threat Intelligence · Sep 25, 14:00 UTC
    ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoftcontext
  2. [2]Zero Day Initiative · Oct 27, 16:39 UTC
    CVE-2026-35273: SSRF to RCE in Oracle PeopleSoftcontext
  3. [3]The Hacker News · Oct 28, 06:04 UTC
    ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flawscontext