Researchers Say ShinyHunters-Exploited PeopleSoft Zero-Day Chains Three Flaws
Summary
ZDI says three PeopleSoft flaws were patched under CVE-2026-35273. Mandiant and GTIG attribute exploitation to ShinyHunters; the article details the SSRF-to-RCE chain and warns patching may not remove attackers already inside.
Key points
- Oracle patched three reported PeopleSoft flaws under CVE-2026-35273 on June 10; ZDI is working with Oracle on separate CVEs.
- The flaw affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62, is rated CVSS 9.8, and allows unauthenticated remote code execution.
- ZDI describes an SSRF in PSIGW that can reach PSEMHUB because its trust list includes the local loopback address by default.
- Attackers can use PSEMHUB to write and run a web shell, or plant a malicious XML file that executes code when the service restarts.
- Mandiant and GTIG attribute exploitation from May 27 to June 9, and a larger September wave, to UNC6240, also known as ShinyHunters.
- Mandiant reported that attackers bypassed WAF rules blocking /PSEMHUB/ by requesting /%50SEMHUB/ instead.
- The article says Oracle's alert does not clarify whether patching removes prior access; Mandiant recommends rotating credentials and hunting for web shells.
Article Details
- Attack Vectors
- An attacker-controlled request to the PeopleSoft Integration Gateway (PSIGW) used SSRF to reach the internal Environment Management Hub (PSEMHUB) through 127.0.0.1, which was trusted by default.
- Once inside PSEMHUB, attackers could write a web shell to the application directory and run commands as the PeopleSoft service account.
- A separate execution path wrote a malicious XML file that Java XMLDecoder processed when the service next started.
- Mandiant reported that ShinyHunters bypassed WAF path rules by requesting /%50SEMHUB/ instead of /PSEMHUB/.
- Defensive Notes
- Oracle released an out-of-band fix for CVE-2026-35273 on June 10.
- Mandiant advised rotating credentials and hunting for web shells; the article notes that patching alone may not remove an attacker who already gained access.
- The article describes URL-encoding a character in the PSEMHUB path to evade WAF rules that match only the plain-text path.
MITRE ATT&CK
T1090.001 · Internal ProxyThe SSRF caused the PeopleSoft server to forward attacker-controlled requests to the internal PSEMHUB interface through its loopback address.T1190 · Exploit Public-Facing ApplicationThe attackers exploited the exposed PeopleSoft PSIGW request handler, using SSRF to reach the internal PSEMHUB interface.T1505.003 · Web ShellAttackers could write a web shell into the PeopleSoft application directory through PSEMHUB.
CVE
People
Threat Actors
ShinyHuntersThe article identifies ShinyHunters as the name better known for the group Mandiant and Google Threat Intelligence Group track as UNC6240, and attributes the PeopleSoft exploitation campaign and September wave to that group.UNC6240Mandiant and Google Threat Intelligence Group attributed the PeopleSoft exploitation campaign between May 27 and June 9, and the September wave, to the group they track as UNC6240; the article says it is better known as ShinyHunters.
Vendors
Products
PeopleSoftThe critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.PeopleSoft Enterprise PeopleToolsCVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over the server over the network. Oracle released its fix in an
Industries
AgricultureIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.EducationIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.GovernmentIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.HealthcareIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.IT servicesIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.TechnologyIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.TransportIn a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.