Shiny Hunters-Exploited Oracle People Soft Zero-Day Turns Out to Be Three Chained Flaws
Summary: The critical Oracle PeopleSoft flaw that ShinyHunters exploited since May is actually three chained vulnerabilities, patched by Oracle under a single identifier, CVE-2026-35273, in June. The chain starts with an SSRF in the Integration Gateway (PSIGW) that reaches the internal Environment Management Hub (PSEMHUB) because allowedhosts.properties ships with 127.0.0.1 already trusted, enabling unauthenticated remote code execution on PeopleTools 8.61 and 8.62, which carries a CVSS score of 9.8.
What's compelling: Mandiant and GTIG attribute activity to UNC6240, better known as ShinyHunters, which exploited the flaw between May 27 and June 9 mostly against universities, then returned in a larger September wave spanning technology, healthcare, agriculture, transport, and government across dozens of systems worldwide. In that wave, Mandiant found the group bypassing WAF rules that blocked /PSEMHUB/ by requesting /%50SEMHUB/ instead, and the sources do not settle whether patching removes access an attacker already gained.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-35273
- Related
- Shiny Hunters Exploits Oracle People Soft Zero-Day (CVE-2026-35273) to Breach Universities Cyber Risks ·Shiny Hunters Renewed Mass Exploitation Campaign Targeting Oracle People Soft Cyber Risks · Sep 25, 2026