ShinyHunters Oracle PeopleSoft Zero-Day: Three Chained Flaws

What happened: one CVE, three chained flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw. It is three chained together, according to Bobby Gould of the Zero Day Initiative (ZDI), whose team reported it to Oracle. The Hacker News covered the breakdown this week.

Oracle patched all three under a single identifier, CVE-2026-35273, in June. ZDI says it reported three distinct vulnerabilities across two PeopleSoft components and is working with Oracle on a separate CVE for each. For now, the June identifier is the only one on record, so check Oracle's alert and ZDI's analysis for updates.

How the chain works

Two components are involved, and both run as separate web applications:

• Integration Gateway (`PSIGW`) exchanges messages with outside systems.

• Environment Management Hub (`PSEMHUB`) is an internal admin interface meant to answer only to trusted hosts.

The attack moves through several stages. We describe them here as stages of the chain, not as a list of the three reported CVEs.

1. SSRF in `PSIGW`. A server-side request forgery lets the attacker control both the address the request forwards to and the full payload. The handler never checks that the destination is legitimate. 2. Default loopback trust. PSEMHUB checks requesters against allowedhosts.properties, and that file ships with 127.0.0.1 already listed. The attacker points the SSRF at the loopback address, the request looks local, and the check passes. 3. Code execution, by one of two routes. ZDI describes both: - Abuse a log-writing command in PSEMHUB. The caller controls file contents and path, so an attacker drops a web shell and runs commands as the PeopleSoft service account. - Write a malicious XML file that PSEMHUB reads with Java's XMLDecoder at the next service start. No web shell is needed, so this route leaves less for standard detection to catch.

ZDI's point is that allowing loopback access by default makes the trust check ineffective once the SSRF exists. A firewall rule alone may not have covered you.

Who is affected

CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Oracle released the fix in an out-of-band security alert on June 10.

Stay on a supported PeopleTools release. Oracle's alert also gives a workaround for servers you cannot patch yet, with separate steps for multi-server and single-server setups. We cover it below.

How serious it is and whether it is exploited

It is serious and actively exploited. The CVSS score is 9.8, and an unauthenticated attacker can take over the server over the network. The flaw is on CISA's Known Exploited Vulnerabilities catalog.

Mandiant and Google Threat Intelligence Group attribute a campaign to UNC6240, better known as ShinyHunters. It exploited the flaw between May 27 and June 9, mostly against universities. Oracle's advisory came on June 10, so this was a zero-day the whole time.

In September, Mandiant reported a larger wave across technology, IT services, healthcare, agriculture, transport and government, affecting dozens of systems worldwide. Attackers also slipped past WAF rules that blocked the /PSEMHUB/ path by requesting /%50SEMHUB/ instead. The WAF matched plain text, while the PeopleSoft server decoded the URL and served the page.

What to do now: patch, then mitigate

The guidance below comes from Oracle and Mandiant.

1. Install the fix from Oracle's June 10 security alert for CVE-2026-35273.

2. If you cannot patch yet, follow Oracle's alert. It advises disabling the Environment Management Hub service in multi-server setups, or removing the PSEMHUB application in single-server setups. Separately, restricting these admin endpoints does not break normal user sessions.

3. Do not rely on WAF path rules. Mandiant is explicit that path-based blocking is not a substitute for patching.

Check your exposure with these commands

Run these on the PeopleSoft web server. Replace the placeholder paths with your own web log and install directories.

First, find the trust list and see whether loopback is on it:

find / -name allowedhosts.properties 2>/dev/null
grep -n "127.0.0.1" /path/to/allowedhosts.properties

Next, search access logs for requests to the admin interface, including the encoded variant:

grep -iE "psemhub|%50semhub" /path/to/web/access/logs/*

Then look for files created since the first known exploitation date. Unexpected script files in the web application directory deserve a close look:

find /path/to/peoplesoft/webserv -type f -newermt "2026-05-27" \( -name "*.jsp" -o -name "*.xml" \)

Expect some noise from legitimate changes. Compare hits against your change records. A match is a lead, not proof. An unexplained file means you should treat the host as possibly compromised.

If you may already be hit

Mandiant recommends three steps:

• Treat any host with a web shell as compromised.

• Preserve evidence before you rebuild or clean anything.

• Rotate every credential reachable from the PeopleSoft tier.

ShinyHunters steals data and then demands payment, so prepare for extortion. Systems exposed between May 27 and your patch date are the ones to review first.

What IT and security learners can take from this

This case shows why one "trusted by default" setting can undo a whole network boundary. Chained flaws, SSRF into internal services and URL-encoding tricks that beat text-matching filters are standard exam and job topics. Our CompTIA Security+ study guide covers the fundamentals behind them. Try rewriting this attack as a diagram, then list which control would break each link.

Browse our cybersecurity certification vouchers when you are ready to turn that practice into a credential.

Sources

• ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (The Hacker News)