Skip to content
HACKTECH
Exploited vulnerabilitiesReported Published 7 sources

Oracle PeopleSoft zero-day CVE-2026-35273 exploited in ShinyHunters data theft

On 10 June 2026 Oracle issued an out-of-band Security Alert for CVE-2026-35273, a CVSS 9.8 vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that can be exploited remotely without authentication and may result in remote code execution. Mandiant reported zero-day exploitation between 27 May and 9 June 2026 and attributed it to UNC6240 (ShinyHunters); 68% of the more than 100 organisations it notified were in higher education. On 25 September Google reported a renewed wave in which the actor got past path-based WAF rules and deployed web shells on dozens of systems.

  • Oracle
  • PeopleSoft
  • ERP
  • ShinyHunters
  • zero-days
  • WAF bypass
  • higher education

What the sources report

  • Oracle's alert scores the flaw 9.8 under CVSS 3.1 for exploitation over HTTP without authentication, and credits researchers from TrendAI Zero Day Initiative and TrendAI Research. Rapid7 notes that TrendAI classifies the underlying flaw as server-side request forgery (CWE-918).
  • Exploitation targeted /PSEMHUB/hub and /PSIGW/HttpListeningConnector. Mandiant said the exploit chain may coerce outbound SMB (TCP 445) connections in an attempt to capture Windows machine-account NetNTLM hashes.
  • After exploitation the attackers installed MeshCentral agents disguised as Microsoft Azure services, such as meshagent64-azure-ops.exe, inspected PeopleSoft configuration files, ran SSH credential-spraying scripts against internal hosts and exfiltrated data with zstd compression. Stolen data appeared on the ShinyHunters leak site on 9 June (Mandiant, Rapid7).
  • Hackers claiming to be affiliated with ShinyHunters told BleepingComputer and TechCrunch they targeted 300 PeopleSoft instances belonging to more than 100 organisations. SecurityWeek, citing BleepingComputer, named the University of Nottingham as one of the victims, and the university confirmed a significant data breach.
  • CISA added the flaw to KEV on 12 June with a 15 June deadline and lists its ransomware use as 'Known'.
  • In the September wave, requests to /%50SEMHUB/ got past WAF and proxy rules that matched the literal string /PSEMHUB/, while WebLogic decoded the path and served the application. Google found that a quarter of the actor's commands ran as root or NT AUTHORITY\SYSTEM, with victims in higher education, technology, IT services, healthcare, agriculture, transportation and government.

What it means for your organisation

ERP platforms hold HR, payroll, student and financial records in one place, so a single pre-authentication flaw gives direct access to data that can be used for extortion. TrendAI says the September wave hit organisations that relied on WAF rules and did not patch, and Google stressed that WAF rules and path-based blocking are not a substitute for patching, since encoding a single character was enough to get past them. TrendAI offered one possible explanation for an internal-only management hub being reachable from outside: a reverse proxy or load balancer in front of WebLogic, which may make outside traffic look internal to the hub. Whatever the cause, it says anyone running PeopleSoft should check whether /PSEMHUB/hub answers from outside their network.

What we check

  • Confirm the patch or mitigations from Oracle's 10 June Security Alert are in place on PeopleTools 8.61 and 8.62, and test from outside the network whether /PSEMHUB/hub and /PSIGW/HttpListeningConnector respond, including encoded variants such as /%50SEMHUB/.
  • Check whether the Environment Management Hub can be disabled or the PSEMHUB application removed, and make sure blocking rules act on the normalised path.
  • Review reverse proxy and load balancer settings so that internal-only PeopleSoft services do not treat proxied external requests as internal.
  • Look for unexpected .jsp, .jspx and .exe files in the PSEMHUB.war and PORTAL.war directories, MeshCentral agents and outbound SMB traffic from PeopleSoft servers.
  • Audit database connection strings in psappsrv.cfg, Integration Broker credentials and service account privileges, rotate any the PeopleSoft tier could read, and test egress filtering for TCP 445 from ERP hosts.

Sources

Services that cover these checks

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works