Oracle issued a single June patch — CVE-2026-35273 — that in effect closed three distinct flaws attackers had been chaining since at least May, researchers said.
CVE-2026-35273: one identifier, three vulnerabilities
What Oracle published in June as a single fix is, according to the Zero Day Initiative (ZDI), the practical closure of three distinct vulnerabilities spanning two PeopleSoft components. ZDI reported the issues to Oracle and said this week that it has identified three separate bugs and is working with Oracle to assign a separate CVE to each; as of this week, CVE-2026-35273 remains the only identifier on the record. Oracle released its correction in an out-of-band security alert on June 10. The entry carries a CVSS score of 9.8, affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, and is listed on CISA's Known Exploited Vulnerabilities catalog.
How an SSRF and a default trust file opened the door
ZDI's technical breakdown names two web applications at the center: the Integration Gateway (PSIGW), which accepts and forwards messages from outside systems, and the Environment Management Hub (PSEMHUB), an internal administrative interface intended to answer only to trusted hosts. The initial weakness is a server-side request forgery (SSRF) in PSIGW. An attacker can send a request to PSIGW's connector that specifies both the destination address and the full payload to forward; the handler performs no verification that the destination is legitimate.
The SSRF by itself would be limited if it could reach only external hosts, but PSEMHUB decides who to trust by consulting an allowedhosts.properties file that ships with the loopback address 127.0.0.1 already listed. An attacker can point PSIGW's SSRF at 127.0.0.1, making the proxied request appear to originate from the local machine; PSEMHUB's trust check then treats the call as local and allows access to internal management functionality.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTwo distinct paths to remote code execution
Once PSEMHUB is reachable from PSIGW, ZDI describes two exploitation paths that can produce remote code execution without prior authentication. The first abuses a PSEMHUB command intended to write log entries: the caller controls both the log contents and the exact file path, enabling an attacker to write a web shell into the application directory and execute commands under the PeopleSoft service account.
The second path avoids a web shell entirely. An attacker can write a malicious XML file that PSEMHUB will read using Java's XMLDecoder when the service next starts; because XMLDecoder can deserialize and execute code, the malicious file runs the attacker's payload during service restart. ZDI notes the second vector is harder to detect with standard signatures and file-scan approaches.
ShinyHunters (UNC6240) exploited the chain in the wild
Security responders found real-world exploitation before Oracle's June 10 advisory. Mandiant and Google Threat Intelligence Group (GTIG) attributed activity between May 27 and June 9 to the group tracked as UNC6240, commonly known as ShinyHunters, noting early targeting mostly against universities. Because that activity predated Oracle's alert, it was a zero-day campaign while it was active. In a September follow-up, Mandiant reported a renewed and larger wave that expanded beyond education into technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.
Mandiant also documented attackers evading web-application firewall (WAF) rules by encoding a single character in the URL: requests for /PSEMHUB/ could slip past WAF rules that matched plain text by requesting /%50SEMHUB/ instead; PeopleSoft decodes and serves the path while many WAF rules do not.
Oracle and Mandiant guidance: patch, or disable and hunt
Oracle's alert and Mandiant's recommendations set the practical response. The principal instruction is to apply Oracle's security alert fix for CVE-2026-35273 and remain on a supported PeopleTools release. Mandiant is explicit that path-based WAF blocking is not a substitute for patching.
- If organizations cannot apply the patch immediately, Oracle advises disabling the Environment Management Hub service in multi-server setups or removing the PSEMHUB application in single-server configurations; those steps restrict the admin endpoints without breaking normal user sessions.
- If an environment may already be compromised, Mandiant recommends treating any host with a web shell as fully compromised, preserving forensic evidence, and rotating every credential reachable from the PeopleSoft tier. The advisory notes ShinyHunters steals data and then demands payment, so affected organizations should prepare for extortion.
One detail the public guidance does not resolve: whether applying the patch evicts attackers who already have access. Oracle's alert does not address that point, and Mandiant's guidance to rotate credentials and hunt for web shells proceeds on the assumption that patching closes the vulnerability but does not necessarily remove an active foothold.
What defenders need to watch now
The practical lesson embedded in ZDI's analysis is specific: a default decision to trust the loopback address undermined the intended trust boundary once an SSRF existed. Defenders who relied on path-based WAF rules or assumed internal admin interfaces were unreachable must treat the patch as mandatory, hunt for web shells and malicious XML payloads, and assume credential compromise until proven otherwise.
https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
