~/home/news/shinyhunters-leverages-oracle-2026-10-30
newsFriday, October 30, 20268 min read👁 0 views

ShinyHunters Leverages Oracle PeopleSoft Zero-Day (CVE-2026-35273) for Critical Unauthenticated RCE

A ShinyHunters-linked campaign is exploiting a newly disclosed Oracle PeopleSoft zero-day (CVE-2026-35273) to achieve unauthenticated remote code execution on on-premises deployments. No patch exists yet; immediate mitigation includes network isolation, disabling external access, and active web-shell hunting.

OraclePeopleSoftZero-DayRemote Code Execution

Overview/Introduction

In early June 2026, the cyber-crime group ShinyHunters announced that it had compromised more than 100 organizations by exploiting a previously unknown vulnerability in Oracle PeopleSoft. The flaw - catalogued as CVE-2026-35273 - grants an unauthenticated attacker the ability to execute arbitrary operating-system commands on vulnerable on-premises PeopleSoft installations. Oracle has not yet released a public fix, and the vulnerability is already being leveraged in the wild, making it a critical threat for any organization that runs PeopleSoft on-premises, especially in the education, government, and enterprise sectors.

Technical Details

According to the Register article dated 28 Oct 2026, the PeopleSoft exploit actually chains together three distinct vulnerabilities:

  • CVE-2026-35273 - the primary entry point, a server-side request forgery (SSRF) that allows an attacker to bypass the PeopleSoft web-application firewall and reach internal services.
  • A secondary path-traversal flaw in the PeopleSoft FileStore component that enables the attacker to write arbitrary files to the web-root.
  • A final web-shell execution vulnerability that runs the uploaded payload with the privileges of the PeopleSoft application server (typically psadm or oracle).

The attack chain works as follows:

1. Unauthenticated HTTP request → SSRF (CVE-2026-35273) → access internal admin endpoints.
2. Crafted payload → Path-traversal → write malicious JSP/ASP file to web root.
3. Trigger the uploaded file → command execution with OS-level privileges.

Because the initial vector is unauthenticated and does not require any valid session cookie, the exploit can be launched from the public Internet against any exposed PeopleSoft portal. The payload is typically a lightweight web shell that provides the attacker with a persistent foothold for data exfiltration or further lateral movement.

Impact Analysis

The vulnerability affects all on-premises Oracle PeopleSoft deployments that expose the PeopleSoft portal to the Internet - a common configuration for universities, state agencies, and large enterprises that use PeopleSoft for HR, finance, and student information systems. The impact is severe for several reasons:

  • Unauthenticated RCE - attackers can execute commands without any credentials.
  • Full OS privileges - the PeopleSoft application server runs with elevated rights, giving the attacker access to sensitive data stores (e.g., student records, payroll, procurement).
  • Persistence via web shells - once a shell is planted, it can survive patching of the original flaw, complicating incident response.
  • Supply-chain risk - many institutions share PeopleSoft instances across multiple campuses, meaning a single compromised server can expose an entire network.

Early reports indicate that ShinyHunters targeted primarily the education sector, but the same technique is applicable to any industry that runs PeopleSoft on-premises.

Timeline of Events

  • May 2026 - Internal security teams at several universities notice anomalous outbound traffic from PeopleSoft servers.
  • Early June 2026 - ShinyHunters publicly claims exploitation of a PeopleSoft zero-day, later identified as CVE-2026-35273.
  • 10 June 2026 - TrendAI’s Zero Day Initiative (ZDI) receives the vulnerability report and assigns CVE-2026-35273.
  • Mid June 2026 - Mandiant confirms data theft and extortion attempts linked to the PeopleSoft exploit.
  • 28 Oct 2026 - The Register publishes a detailed analysis, revealing the three-vulnerability chain and noting that Oracle has not yet released a patch.

Mitigation/Recommendations

Because Oracle has not yet issued a patch, defenders must rely on defense-in-depth and rapid containment:

  1. Network Isolation: Immediately segment PeopleSoft web servers from the public Internet. Use firewalls or a DMZ to restrict inbound traffic to trusted IP ranges (e.g., corporate VPN, internal load balancers).
  2. Disable Unnecessary Services: Turn off any publicly reachable admin endpoints (e.g., /psp/ps/PEOPLE/HRMS admin consoles) and enforce strict URL filtering.
  3. Web-Shell Hunting: Deploy file integrity monitoring (FIM) on the PeopleSoft web root. Look for newly created JSP/ASP files, especially those with suspicious names (e.g., shell.jsp, cmd.asp).
  4. Application Hardening:
    • Enable Oracle’s built-in request validation and CSRF protection.
    • Enforce least-privilege for the PeopleSoft service account - it should not have OS-level sudo rights.
    • Apply strict Content-Security-Policy (CSP) headers to block inline script execution.
  5. Patch Readiness: Subscribe to Oracle Security Alerts and prepare to apply the upcoming patch as soon as it is released. Test the patch in a staging environment before production rollout.
  6. Log Monitoring & Alerting: Correlate HTTP request logs for unusual SSRF patterns (e.g., outbound requests to internal IP ranges) and trigger alerts on file-write events in the web root.

Organizations that have already seen signs of compromise should conduct a full forensic review, rotate all service account passwords, and assume that any uploaded web shell may have been used to exfiltrate data.

Real-World Impact

For a university, the compromise of PeopleSoft can expose:

  • Student personal data (names, addresses, grades, financial aid information).
  • Faculty payroll and research grant details.
  • Internal network diagrams that facilitate further lateral movement.

In the corporate world, the same breach could reveal employee compensation data, vendor contracts, and strategic financial forecasts - all of which are prime targets for extortion. The fact that ShinyHunters is already demanding ransom after data theft underscores the immediate financial risk.

Expert Opinion

From a strategic standpoint, the PeopleSoft zero-day highlights two worrying trends:

  1. Supply-chain exposure of legacy ERP/HR platforms. Many organizations continue to run PeopleSoft on-premises because migration to cloud SaaS alternatives is costly and complex. This creates a large attack surface that attackers can exploit with relatively low effort.
  2. Multi-vector chaining. The exploit does not rely on a single flaw but stitches together three separate bugs. Defensive teams that focus on patching individual CVEs may miss the broader picture, allowing attackers to bypass mitigations.

Security teams should therefore adopt a “kill-chain” mindset: monitor for each stage of the attack, not just the final RCE. Investing in runtime application self-protection (RASP) and continuous file-integrity monitoring can provide early detection before a web shell establishes persistence.

Finally, the lack of an immediate patch puts pressure on Oracle to accelerate its response cadence. Organizations that cannot wait for a vendor fix must treat PeopleSoft as a high-risk asset and consider temporary migration to a cloud-based HR/ERP solution or, at the very least, enforce strict network segmentation until a fix is available.