Oracle PeopleSoft — Exploited Zero-Day Turns Out to Be Three Chained Flaws (CVE-2026-35273)

Publication date: October 28, 2026
Category: Vulnerability / Enterprise Security

Introduction

The critical vulnerability affecting Oracle PeopleSoft, actively exploited in threat campaigns since May, is not a single isolated flaw but rather a sophisticated chain of three distinct vulnerabilities combined together. Security researchers reported this week that Oracle originally patched the entire chain under a single identifier, CVE-2026-35273, in June. The zero-day exploitation campaign has been attributed by threat intelligence groups to the cluster tracked as UNC6240, widely known as ShinyHunters, initially targeting educational institutions before expanding to broader global sectors including technology, healthcare, and government agencies.

What is CVE-2026-35273? (General Analysis)

The identifier CVE-2026-35273 represents a series of architectural design issues within the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. According to official data confirmed by the National Vulnerability Database (NVD), this flaw carries a CVSS 3.1 Base Score of 9.8 (Critical) with the exact vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This indicates that an unauthenticated remote attacker with network access can achieve full server takeover over HTTP without requiring prior credentials. Its official CWE classification is CWE-306 (Missing Authentication for Critical Function), and the vulnerability is listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The core risk stems from PeopleSoft trusting its own loopback address by default, which allows redirected external requests to successfully reach internal administrative interfaces that should remain heavily guarded.

How Does It Work? (Technical Analysis)

Detailed analysis from the Zero Day Initiative (ZDI) breaks down the technical mechanism through which an attacker successfully chains these weaknesses to achieve unauthenticated remote code execution (RCE):

  • Initial Entry Flow (SSRF): The first affected component is the Integration Gateway (PSIGW), which handles message exchanges with external systems. An attacker sends a crafted request to its listening connector, controlling both the forwarding destination and the full payload, as the handler performs no validation to verify if the target is legitimate.
  • Local Loopback Trust Bypass: The Environment Management Hub (PSEMHUB) acts as an internal administrative interface intended to answer exclusively to trusted hosts verified against an allowedhosts.properties file, which ships with the local loopback address 127.0.0.1 pre-configured. By pointing the PSIGW server-side request forgery (SSRF) at 127.0.0.1, the request appears to originate locally, successfully passing the trust validation check.
  • Remote Code Execution (RCE): Once inside PSEMHUB, ZDI documented two distinct execution paths:
    1. Log Writing Abuse: Abusing a PSEMHUB command intended for logging where the caller dictates both file contents and the exact disk path, enabling an attacker to drop a web shell into the application directory and execute commands under the PeopleSoft service account.
    2. XML Deserialization: Writing a malicious XML file processed via Java’s XMLDecoder during the subsequent service restart, executing arbitrary code without planting a persistent web shell.
  • WAF Evasion: During later waves of the campaign, ShinyHunters bypassed Web Application Firewall (WAF) rules blocking the /PSEMHUB/ path by url-encoding a single character, requesting /%50SEMHUB/ instead. While WAF signature matching failed on plain-text evaluation, the PeopleSoft server correctly decoded the path and served the administrative endpoint.

Affected Systems / Environments

  • Affected Product: Oracle PeopleSoft Enterprise PeopleTools.
  • Supported Vulnerable Versions: Versions 8.61 and 8.62.
  • Components Involved: Updates Environment Management (comprising Integration Gateway - PSIGW and Environment Management Hub - PSEMHUB).
  • Impacted Global Sectors: Universities, technology providers, IT services, healthcare, agriculture, transport, and government organizations.
CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-35273 CWE-306 (Missing Auth) Total Confidentiality, Integrity, and Availability 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Patch Application: Immediately install Oracle’s out-of-band security alert fix for CVE-2026-35273 and remain on a supported PeopleTools release.
  • Hardening Workarounds: If immediate patching is not feasible, disable the Environment Management Hub service in multi-server setups, or remove the PSEMHUB application entirely in single-server deployments as advised by Oracle’s security alert. Restricting these administrative endpoints does not disrupt normal user sessions.
  • Credential Hygiene: Rotate all credentials reachable from the PeopleSoft tier and treat any host with detected artifacts as fully compromised.

Detection

  • IoC and Artifact Hunting: Incident responders should audit PeopleSoft web directories for unauthorized files or modifications, monitoring access logs for url-encoded path patterns (/%50SEMHUB/).
  • Endpoint Threat Hunting: Inspect system logs for anomalous execution processes spawned by the PeopleSoft service account and verify configuration integrity alongside Java temporary directories.

Defensive Intelligence Advisory: Applying the patch closes the entry door but does not automatically evict an adversary who has already gained internal access. Any host found hosting a web shell must be treated as fully compromised, requiring immediate isolation, forensic preservation, and credential rotation.

Wrapping Up

The zero-day exploitation of Oracle PeopleSoft by the ShinyHunters threat group illustrates how chaining seemingly localized flaws—such as an SSRF combined with a loopback trust assumption—can lead to critical enterprise infrastructure takeover. The tenacity of threat actors in bypassing perimeter defenses via path encoding reinforces the critical need to prioritize rapid patch management over reliance on perimeter WAF filtering alone.

References