Oracle PeopleSoft Zero-Day Vulnerability (CVE-2026-35273) Exploited by ShinyHunters

THE THREAT

On June 10th, 2026, Oracle disclosed a critical unauthenticated Remote Code Execution (RCE) vulnerability impacting its Oracle PeopleSoft PeopleTools application, tracked as CVE-2026-35273 (CVSS: 9.8). Successful exploitation of the flaw can result in full takeover of PeopleSoft Enterprise PeopleTools.

On June 11th, Mandiant and Google Threat Intelligence Group (GTIG) published a report confirming that exploitation of the flaw has been ongoing since at least May 27th, marking it a zero-day. The identified attacks were attributed to ShinyHunters, who leveraged CVE-2026-35273 as an initial access method to conduct data extortion attacks.

As exploitation is ongoing, organizations utilizing Oracle PeopleSoft should ensure that relevant patches are applied as soon as possible.

What we’re doing about it

• eSentire's Threat Response Unit (TRU) is performing threat hunts for known Indicators of Compromise (IoC) associated with exploitation
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire MDR for Endpoint has detections in place to identify malicious MeshAgent activity
• eSentire's TRU team is evaluating detection opportunities and actively tracking this topic for additional details

What you should do about it

• After performing a business impact review, apply the relevant security patches
• If patches cannot immediately be applied, organizations can take the following mitigation steps:
  • Disable the Environment Management Hub (EMHub) Service
  • Block external network access to PeopleSoft PeopleTools, and sensitive endpoints (specifically /PSEMHUB/hub/ and /PSIGW/HttpListeningConnector) at the network perimeter or firewall level
• Organizations should review the following items to identify potential compromise:
  • Audit the PIA WebLogic access logs for HTTP POST requests directed at /PSEMHUB/hub and /PSIGW/HttpListeningConnector originating from external or untrusted source IP addresses
  • Monitor outbound firewall logs and NetFlow data for outbound SMB traffic (port 45) originating from PeopleSoft hosts to untrusted destinations
  • Conduct a forensic audit of the web-tier filesystem on PeopleSoft hosts

Additional information

ShinyHunters is a financially motivated threat actor that has been active since 2019. ShinyHunters has been known to conduct data extortion operations using social engineering and voice phishing (vishing) to gain access to enterprise environments and exfiltrate data. Mandiant and GTIG identified ShinyHunters exploiting CVE-2026-35273 to gain initial access to target organizations, two weeks prior to the patch release. Once initial access was gained, the threat actors deployed customized MeshCentral agents disguised as legitimate cloud endpoints, which they used to run queries, perform lateral movement, and deploy custom scripts. Data was exfiltrated from target environments and posted on ShinyHunters' Data Leak Site (DLS) on June 9th.

GTIG indicates that they notified over 100 global organizations whose IP addresses “correlated with potentially vulnerable endpoints”, noting that the majority of these organizations were in the United States, and that 68% of them were in the higher education sector. This sector's heavy reliance on Enterprise Resource Planning (ERP) platforms like Oracle PeopleSoft for managing student, financial, and HR data makes it a high-value target for extortion groups seeking large, monetizable datasets. eSentire's Threat Intelligence team assesses with medium confidence that because the campaign has been publicized, ShinyHunters may try to rapidly exploit Internet-exposed Oracle PeopleSoft applications before organizations are able to apply patches. Given that exploitation of CVE-2026-35273 is ongoing, organizations should ensure that relevant patches or mitigation steps outlined are applied as soon as possible.

References:

[1] https://www.oracle.com/security-alerts/alert-cve-2026-35273.html 
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-35273 
[3] https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit