PeopleSoft PeopleTools RCE Exploited Through PSIGW SSRF and XMLDecoder Chain
Summary
Trend Micro details in-the-wild exploitation of CVE-2026-35273 in PeopleTools 8.61 and 8.62. The chain uses PSIGW SSRF and XMLDecoder for in-JVM RCE; Oracle released an out-of-band patch on June 10, 2026.
Key points
- The unauthenticated exploit uses the PSIGW gateway to reach the internal PSEMHUB servlet through an SSRF request.
- Attackers can plant XML that XMLDecoder executes inside the WebLogic JVM after a web-tier restart.
- Trend Micro reports exploitation beginning May 27, 2026; Mandiant attributed activity to SHADOW-AETHER-015 and reported more than 100 targeted organizations.
- The affected versions are PeopleTools 8.61 and 8.62, including installations with earlier patches; Oracle assigned CVE-2026-35273 a CVSS score of 9.8.
- The in-process execution may produce no child-process activity or network-visible loopback request, complicating conventional detection.
- Oracle released an out-of-band patch on June 10, 2026; defenders are advised to patch and investigate for prior compromise.
- Recommended hunts include unexpected writes in PeopleSoft environment metadata paths, suspicious activity around web-tier restarts, JSP files in PSEMHUB.war, and outbound SMB from web-tier hosts.
Article Details
- Attack Vectors
- An unauthenticated request to /PSIGW/HttpListeningConnector uses SSRF to make the gateway reach the internal PSEMHUB hub through localhost.
- Attacker-controlled XML is staged under envmetadata/transactions/ and planted under envmetadata/data/environment/; on a web-tier restart, XMLDecoder deserializes it and executes attacker-chosen code inside the WebLogic JVM.
- Optional post-exploitation methods described are a JSP web shell in the PSEMHUB.war docroot and outbound SMB/445 coercion to capture or relay machine-account NetNTLM credentials.
- Defensive Notes
- Apply Oracle’s out-of-band patch for CVE-2026-35273 to PeopleTools 8.61 and 8.62; investigate for prior compromise even after patching.
- Restrict untrusted-network access to /PSIGW/HttpListeningConnector and prevent the gateway from reaching the PSEMHUB hub through a loopback SSRF pivot.
- Monitor writes under envmetadata/transactions/ and envmetadata/data/environment/, while accounting for legitimate writes by PeopleSoft Change Assistant and Veritas NetBackup.
- Treat web-tier restarts and XMLDecoder activity in the PSEMHUB context as security-relevant; hunt for new JSP files in the PSEMHUB.war docroot.
- Restrict outbound SMB/445 from web-tier hosts. Preserve envmetadata/ contents and web-tier restart logs during incident response.
MITRE ATT&CK
T1187 · Forced AuthenticationOptional outbound SMB/445 coercion is used to capture or relay machine-account NetNTLM credentials.T1190 · Exploit Public-Facing ApplicationUnauthenticated SSRF through POST /PSIGW/HttpListeningConnector reaches the internal PSEMHUB hub and enables XMLDecoder code execution.T1505.003 · Web ShellAn optional JSP web shell may be dropped into the PSEMHUB.war docroot.
CVE
People
Threat Actors
Vendors
Products
PeopleSoftPeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVMPeopleSoft Enterprise PeopleToolscode execution vulnerability (CVSS 9.8) in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools.PeopleSoft PeopleToolsPeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVMTrendAI Deep DiscoveryTrendAI Deep SecurityTrendAI TippingPointTrendAI Vision Onethe network and endpoint layers, including TrendAI™ Deep Discovery rules and TrendAI™ TippingPoint, TrendAI Vision One™ Server and Workload Protection (SWP), and TrendAI™ Deep Security filters.TrendAI Vision One Endpoint Security IPSTrendAI Vision One Server and Workload ProtectionTrendAI Vision One Threat Intelligence HubTrendAI Vision One XDR Data Explorer AppWebLogicThe chain is behaviorally quiet: Its final step executes inside the WebLogic JVM on a web-tier restart, with no spawned child process and no required outbound beacon.