Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day RCE Under Active Exploit | June 2026

Oracle has issued an emergency security alert for CVE-2026-35273, a critical zero-day vulnerability in PeopleSoft Enterprise PeopleTools that enables unauthenticated remote code execution. The ShinyHunters extortion gang is actively exploiting this flaw to breach enterprise systems, steal data, and demand ransom payments. The campaign has already hit more than 100 organizations, with universities making up the majority of confirmed victims.

What Happened: ShinyHunters Exploits Oracle PeopleSoft Zero-Day in Mass Data Theft Campaign

On June 10, 2026, Oracle published a security advisory confirming CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools. The vulnerability carries a CVSS base score of 9.8. It is remotely exploitable without authentication and requires no user interaction. Consequently, any internet-exposed PeopleSoft instance with the Environment Management Hub (PSEMHUB) reachable from outside is at immediate risk.

Google’s Mandiant intelligence team attributes the ongoing exploitation to UNC6240, a group publicly known as ShinyHunters. Mandiant traced attacker activity between May 27 and June 9, 2026. During that window, the group allegedly compromised more than 300 PeopleSoft instances across over 100 organizations. Oracle released mitigations on June 10, but a comprehensive patch remains pending.

Technical Details of the CVE-2026-35273 Exploit

The vulnerability resides in the Updates Environment Management component, which powers the Environment Management Hub (PSEMHUB). An unauthenticated attacker can send a crafted HTTP request to vulnerable endpoints and achieve remote code execution with server-level privileges.

Furthermore, Mandiant discovered exposed attacker infrastructure that revealed the full exploitation chain. The threat actors operated staging servers running Python’s SimpleHTTP server on port 8888. These servers hosted MeshCentral remote-management agents disguised as Microsoft Azure binaries. The agents communicated with a command-and-control server at azurenetfiles.net, a domain chosen to mimic legitimate Azure NetApp Files infrastructure.

A lateral-movement script named [victim]_fanout.sh spread over SSH by spraying hardcoded credentials against internal hosts. The script also dropped a marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into PeopleSoft directories. In addition, attackers compressed stolen data with zstd and transmitted it via SSH to the server hosting the ShinyHunters leak site.

Affected Products and Versions

• Oracle PeopleSoft Enterprise PeopleTools 8.61
• Oracle PeopleSoft Enterprise PeopleTools 8.62
• Earlier unsupported versions are likely vulnerable as well

Known Indicators of Compromise

• Staging IPs: 142.11.200.186, 142.11.200.187, 142.11.200.188, 142.11.200.189, 142.11.200.190
• Additional attacker infrastructure: 108.174.202.99, 176.120.22.24
• C2 domain: azurenetfiles.net
• Marker files: README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT
• Suspicious directories under PSEMHUB paths: logs, persistantstorage, scratchpad

Business and Operational Impact

The ShinyHunters campaign has already caused significant damage across multiple sectors. Universities have borne the brunt of the attacks, but any organization running exposed PeopleSoft instances is a potential target.

• Education Sector: 68% of impacted organizations are in higher education, most located in the United States.
• Confirmed Victim: The University of Nottingham confirmed a breach affecting approximately 455,000 current students and alumni. Exposed data includes names, addresses, phone numbers, passport numbers, ethnicity details, and disability records.
• Data Volume: ShinyHunters claims to have stolen data from over 300 PeopleSoft instances.
• Extortion Model: The group demands payment to prevent public leaks. Victim outreach is ongoing, and more names are expected to surface.
• Reputational Risk: Organizations face regulatory scrutiny, potential GDPR or state privacy law violations, and loss of stakeholder trust.

Mitigation and Recommendations

Oracle has released emergency mitigations while a full patch is under development. Organizations running PeopleSoft should act immediately to reduce exposure and hunt for signs of compromise.

Immediate Actions for Defenders

1. Disable PSEMHUB. On multi-server deployments, disable the Environment Management Hub service. On single-server setups, remove the PSEMHUB application entirely.
2. Block External Access. If disabling PSEMHUB is not possible, block all external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the perimeter.
3. Apply Oracle Mitigations. Follow Oracle’s emergency guidance available through My Oracle Support document ID CPU187.
4. Inspect Logs. Search WebLogic access logs for external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector.
5. Hunt for Persistence. Look for unexpected JSP files under the PSEMHUB.war directory, anomalous directories under PSEMHUB paths, and recently modified XML files under envmetadata/data/environment that could enable XMLDecoder persistence.
6. Monitor Outbound SMB. Watch for PeopleSoft hosts initiating outbound SMB traffic on port 445 to external destinations, which may indicate hash capture attempts.

Important Notes

Mandiant warns that web application firewall body-inspection rules alone are insufficient, since attackers can bypass them. Moreover, restricting the PSEMHUB endpoints does not disrupt normal user sessions. Therefore, perimeter blocking is a safe and effective immediate step.

Bottom line: CVE-2026-35273 is a maximum-severity, unauthenticated RCE vulnerability under active exploitation by a capable extortion group. If you run Oracle PeopleSoft with externally reachable components, treat this as an active incident and apply mitigations today.

Incident Summary

CVE ID / Incident:	CVE-2026-35273
Affected Systems:	Oracle PeopleSoft Enterprise PeopleTools 8.61, 8.62 (and likely earlier versions)
Severity:	CVSS 9.8 (Critical)
Disclosure Date:	June 10, 2026
Patch Status:	Emergency mitigations available; full patch pending
Threat Actor:	ShinyHunters (UNC6240)
Activity Window:	May 27 – June 9, 2026
Estimated Victims:	300+ instances across 100+ organizations

References

1. Oracle, “Security Alert: CVE-2026-35273,” June 10, 2026, https://www.oracle.com/security-alerts/alert-cve-2026-35273.html (accessed June 11, 2026).
2. Google Mandiant, “ShinyHunters Targets Education Sector With Oracle Exploit,” June 2026, https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/ (accessed June 11, 2026).
3. BleepingComputer, “Oracle mitigates PeopleSoft zero-day exploited in data theft attacks,” June 11, 2026, https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/ (accessed June 11, 2026).
4. The Hacker News, “ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities,” June 11, 2026, https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html (accessed June 11, 2026).
5. Charles Carmakal (Mandiant CTO), LinkedIn post confirming active exploitation, June 2026, https://www.linkedin.com/posts/charlescarmakal_urgent-multiple-0-day-vulnerabilities-share-7470696836803117057-mf6m/ (accessed June 11, 2026).
6. Have I Been Pwned, “University of Nottingham” breach entry, https://haveibeenpwned.com/Breach/UniversityOfNottingham (accessed June 11, 2026).