cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Google Confirms ShinyHunters Exploited PeopleSoft Zero-Day

· Original article ↗

Summary

Google says ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft from May 27 to June 9; some organizations were compromised and data stolen. Oracle issued mitigations, but patches were not available.

Key points

  • CVE-2026-35273 is a critical unauthenticated remote-code-execution vulnerability affecting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, as well as PeopleSoft Enterprise Applications.
  • Mandiant and Google Threat Intelligence Group observed exploitation between May 27 and June 9 and attributed the activity to ShinyHunters, tracked by Google as UNC6240.
  • Google said some targets blocked the attacks, while others had systems compromised and data stolen; the University of Nottingham was identified as the first confirmed victim.
  • Google notified more than 100 organizations of potential exposure. The majority were in the US, and 68% were in higher education.
  • ShinyHunters claimed to have targeted roughly 300 PeopleSoft instances belonging to 100 organizations.
  • Researchers said attacker staging environments used customized MeshCentral agents disguised as cloud endpoints to run administrative queries and deploy a lateral-movement and defacement script.
  • Oracle issued an out-of-band advisory and mitigations, but patches did not appear to be available. Google also shared remediation and hardening recommendations.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
Severity
Critical
Affected Versions
  • PeopleSoft Enterprise PeopleTools 8.61
  • PeopleSoft Enterprise PeopleTools 8.62
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unavailable

MITRE ATT&CK

T1059.004 · Unix ShellAttackers deployed a custom lateral-movement and defacement script named [victim_abbreviation]_fanout.sh.T1190 · Exploit Public-Facing ApplicationThe vulnerability in PeopleSoft was exploited remotely to gain code execution.

CVE

CVE-2026-35273Oracle Corporation · PeopleSoft Enterprise PeopleToolsOracle has released an out-of-band advisory and security alert for CVE-2026-35273, a critical unauthenticated remote code execution vulnerability impacting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, as

Threat Actors

ShinyHuntersGoogle and Mandiant attributed exploitation of CVE-2026-35273 and resulting data theft to ShinyHunters.UNC6240Google tracks ShinyHunters as UNC6240 and attributed the PeopleSoft vulnerability exploitation and data theft to the group.

Vendors

OracleGoogle has confirmed that a PeopleSoft vulnerability mitigated by Oracle this week has been exploited by ShinyHunters as a zero-day to steal data from organizations.TrendAITrendAI (Trend Micro’s enterprise business), whose researchers have been credited by Oracle for reporting CVE-2026-35273, told SecurityWeek that it’s currently seeing limited exploitation of the vulnerability, but its

Products

PeopleSoft Enterprise Applicationsimpacting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, as well as PeopleSoft Enterprise Applications.PeopleSoft Enterprise PeopleToolsCVE-2026-35273, a critical unauthenticated remote code execution vulnerability impacting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, as well as PeopleSoft Enterprise Applications.

Tools

MeshCentral“The attacker staging environments hosted customized MeshCentral agents masquerading as legitimate cloud endpoints, which they used to run administrative command queries and deploy a custom lateral movement and

Countries

United StatesGoogle’s researchers notified more than 100 global organizations of potential exposure, the majority of which are based in the US, with 68% in the higher education sector.

Industries

Higher EducationGoogle’s researchers notified more than 100 global organizations of potential exposure, the majority of which are based in the US, with 68% in the higher education sector.

Related Articles