Oracle Mitigates PeopleSoft Zero-Day Used in ShinyHunters Data-Theft Attacks
Summary
Oracle issued emergency mitigations for CVE-2026-35273, an unauthenticated RCE in PeopleSoft PeopleTools 8.61/8.62. Mandiant confirmed zero-day exploitation; ShinyHunters claimed involvement, and Mandiant notified over 100 potentially exposed organizations.
Key points
- CVE-2026-35273 is a critical, unauthenticated remote-code-execution vulnerability in Oracle PeopleSoft PeopleTools, with a CVSS score of 9.8; versions 8.61 and 8.62 are affected.
- Oracle released emergency mitigations and said a patch is coming. Oracle had not stated that the vulnerability was actively exploited.
- Mandiant reported that threat actors exploited the flaw as a zero-day and said it notified more than 100 organizations with potentially vulnerable endpoints; 68% were in higher education.
- ShinyHunters claimed responsibility for the attacks. BleepingComputer reported the group allegedly stole data from 300 instances across more than 100 organizations.
- Mandiant reported use of customized MeshCentral agents disguised as Microsoft Azure services, along with reconnaissance, configuration mapping, and scripts for lateral movement.
- Mandiant advised restricting access to sensitive PeopleSoft endpoints, reviewing logs for suspicious requests to /PSEMHUB/ and /PSIGW/HttpListeningConnector, and checking for webshells and unauthorized files.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- PeopleSoft Enterprise PeopleTools 8.61
- PeopleSoft Enterprise PeopleTools 8.62
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Restrict access to sensitive PeopleSoft endpoints tied to the exploit chain.
- Review logs for suspicious requests targeting /PSEMHUB/ and /PSIGW/HttpListeningConnector.
- Inspect systems for webshells, unauthorized files, or other indicators of compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]174[.]202[.]99 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]186 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]187 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]188 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]189 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]190 | IP address reported as used in the PeopleSoft attacks. |
| IPV4 | 176[.]120[.]22[.]24 | IP address reported as used in the PeopleSoft attacks. |
MITRE ATT&CK
T1036 · MasqueradingCustomized MeshCentral remote management agents were disguised as Microsoft Azure services.T1059 · Command and Scripting InterpreterThe report says scripts were used to move laterally across internal systems, without specifying a scripting language.T1190 · Exploit Public-Facing ApplicationThreat actors exploited the remotely exploitable, unauthenticated PeopleSoft vulnerability to compromise instances.T1219 · Remote Access ToolsCustomized MeshCentral remote management agents were used to manage compromised systems.
CVE
People
Threat Actors
Vendors
MandiantThe flaw has been used in ShinyHunters data theft attacks against more than 100 organizations, with Mandiant confirming active exploitation and Oracle releasing emergency mitigations.OracleOracle is warning about a critical zero-day in PeopleSoft PeopleTools, tracked as CVE-2026-35273, which allows unauthenticated remote code execution and affects versions 8.61 and 8.62.
Products
Azurethe attacks, including the use of customized MeshCentral remote management agents disguised as Microsoft Azure services and infrastructure used to stage tools and manage compromised systems.Oracle PeopleSoft PeopleToolsOracle is warning about a critical zero-day in PeopleSoft PeopleTools, tracked as CVE-2026-35273, which allows unauthenticated remote code execution and affects versions 8.61 and 8.62.PeopleSoft Enterprise ApplicationsOracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability,” reads a new Oracle advisory.WebLogicThe researchers said the threat actors conducted reconnaissance on compromised networks, mapped PeopleSoft and WebLogic configurations, and used scripts to laterally move across internal systems.