Zero Day Initiative analysis reported October 27 to 28, 2026; Oracle fix released June 10, 2026
The PeopleSoft Flaw ShinyHunters Exploited Since May Was Three Chained Bugs, Not One
The critical Oracle PeopleSoft flaw that ShinyHunters exploited as a zero-day is a chain of three distinct vulnerabilities, not a single bug, according to a Zero Day Initiative analysis by Bobby Gould reported this week. Oracle patched all three under one identifier, CVE-2026-35273 (CVSS 9.8), in an out-of-band security alert on June 10; the flaw affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62, sits on the CISA KEV catalog, and lets an unauthenticated attacker take over the server over the network. The chain starts with a server-side request forgery in the Integration Gateway (PSIGW): the Environment Management Hub (PSEMHUB) decides who to trust from an allowedhosts.properties file that ships with the loopback address 127.0.0.1 already allowed, so a forged request appears to come from the machine itself and reaches the internal admin interface. From there, ZDI described two routes to code execution, writing a web shell through a log-writing command, or planting a malicious XML file that Java's XMLDecoder runs at the next service start. Mandiant and Google Threat Intelligence Group attribute exploitation between May 27 and June 9, mostly against universities, to UNC6240, better known as ShinyHunters, and Mandiant reported a larger September wave across technology, IT services, healthcare, agriculture, transport, and government. ZDI says it is working with Oracle to assign a separate CVE to each flaw; as of this week the June identifier is still the only one on the record.
Executives
A patch applied in June closed three doors, and the new analysis shows how much depended on one default setting: an internal admin tool that trusted requests from the machine itself. If your organization runs PeopleSoft for payroll or human resources and patched late, the question is not whether the door is closed now, but whether anyone walked through it between May and your patch date.
CIO / CISO
Confirm the June security alert fix is applied on every PeopleTools 8.61 and 8.62 instance, including test and standby servers, and treat path-based web application firewall rules as no defense: Mandiant found the September wave bypassing them by URL-encoding one character in the PSEMHUB path. Hunt for the web shells and XML files ZDI describes, and rotate every credential reachable from the PeopleSoft tier on any host where you find them.
Engineers
Apply the CVE-2026-35273 fix and stay on a supported PeopleTools release. If you cannot patch yet, follow Oracle's alert: disable the Environment Management Hub service in multi-server setups or remove the PSEMHUB application in single-server setups. Review allowedhosts.properties on every hub, and search application directories for new JSP files and unexpected XML in hub paths dating from May onward.
Everyone (non-IT)
PeopleSoft holds payroll and personnel records at many large employers and universities. If your employer announces a review tied to this flaw, follow its instructions on credential changes and watch for extortion claims, because the group behind the exploitation steals data and then demands payment.