ShinyHunters, a cyber threat group, has exploited a series of three chained vulnerabilities in Oracle PeopleSoft since May, as reported by The Hacker News.
The vulnerability or weakness
The critical flaw is rooted in a server-side request forgery (SSRF) in the Integration Gateway (PSIGW) component, allowing attackers to send requests to a listening connector and control the destination and payload. This SSRF can reach the Environment Management Hub (PSEMHUB), which trusts the requester based on a list in allowedhosts.properties. The vulnerabilities are tracked under CVE-2026-35273 with a CVSS score of 9.8 and are part of the Known Exploited Vulnerabilities (KEV) list.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-35273 | 9.8 | CRITICAL | Yes, added 2026-06-12 | 2026-06-15 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws (2026-10-23) - The Hacker News
- High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 (2026-10-21)
Business impact
Organizations using Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are at risk of remote code execution, potentially leading to significant operational disruptions, data breaches, and financial losses. The vulnerability could also affect legal and regulatory compliance, impacting the organization's reputation.
Industries affected
The attack primarily targeted universities but has since expanded to technology, IT services, healthcare, agriculture, transport, and government sectors.
Users affected
Users of Oracle PeopleSoft are at risk of having their systems compromised, potentially leading to unauthorized access, data theft, and operational disruptions. This could impact the users' ability to perform critical business functions and maintain data integrity.
