CVE-2026-35273
published 2026-06-11CVE-2026-35273: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2026-06-15
Exploited in the wild
EPSS
96.68%
99.9th percentile
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_peopletools | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandnode meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh'↗
- →Alert on HTTP POST requests from external source IPs to /PSEMHUB/hub and /PSIGW/HttpListeningConnector in WebLogic access logs. ↗
- →Flag requests to /PSIGW/HttpListeningConnector containing loopback addresses or internal IP ranges in headers or parameters as potential SSRF exploitation. ↗
- →Hunt for unexpected .jsp files under the PSEMHUB.war web application directory as a post-exploitation indicator. ↗
- →Hunt for unauthorized files or directories under PSEMHUB.war/envmetadata/transactions/ as a post-exploitation indicator. ↗
- →Hunt for unexpected directories named logs, persistantstorage, or scratchpad under PSEMHUB paths. ↗
- →Hunt for recently created or modified .xml files under /envmetadata/data/environment/ which may indicate XMLDecoder persistence that fires on server restart. ↗
- →Monitor outbound SMB (TCP/445) from PeopleSoft hosts to external destinations; the exploit chain may coerce outbound connections to capture Windows machine-account NetNTLM hashes. ↗
- →Detect MeshCentral agents masquerading as Azure services by hunting for processes or binaries named meshagent64-azure-ops.exe or meshagent32-azure-ops.exe with C2 to azurenetfiles.net. ↗
- →Presence of README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in PeopleSoft webserv or appserv directories is a definitive compromise marker. ↗
- →TrendAI IPS Rule 1012580 and DDI Rule 5855 provide vendor detection signatures for the SSRF exploitation of CVE-2026-35273. ↗
- →Staging servers ran Python's SimpleHTTP server on port 8888; scanning for this service on attacker IPs can help identify infrastructure. ↗
- ·The exploit chain is multi-stage: SSRF via /PSEMHUB/hub is chained with /PSIGW/HttpListeningConnector and XMLDecoder persistence; WAF body-inspection rules alone are insufficient as they can be bypassed. ↗
- ·Blocking /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter is considered non-breaking for standard end-user PIA browser sessions. ↗
- ·Exploitation predates the patch by two weeks (May 27 – June 9, 2026); organizations should hunt for compromise indicators even after patching, as XMLDecoder payloads persist and execute on next server restart. ↗
- ·Earlier, unsupported PeopleTools versions beyond 8.61 and 8.62 are also likely vulnerable per Oracle. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).
ghsa_unreviewed·2026-06-11
CVE-2026-35273 [CRITICAL] CWE-306 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle peoplesoft_enterprise_peopletools Missing Authentication for Critical Function
vulncheck·2026·CVSS 9.8
CVE-2026-35273 [CRITICAL] Oracle peoplesoft_enterprise_peopletools Missing Authentication for Critical Function
Oracle peoplesoft_enterprise_peopletools Missing Authentication for Critical Function
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected: Oracle peoplesoft_enterprise_peopletools
Required Action: Apply remediations or mitigations per vendor instructions or discontinue
CISA
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
cisa·2026-06-12·CVSS 9.8
CVE-2026-35273 [CRITICAL] CWE-306 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Vulnerability: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Affected: Oracle PeopleSoft Enterprise PeopleTools
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
No detection rules found.
Nuclei
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
nuclei·CVSS 9.8
CVE-2026-35273 [CRITICAL] Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.
Template:
id: CVE-2026-35273
info:
name: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
author: DhiyaneshDk
severity: critical
description: |
Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.
impact: |
Unauthenticated attackers can fully compromise PeopleSoft Enterpris
Recorded Future
September 2026 CVE Landscape
blogs_recorded_future·2026-10-13·CVSS 9.8
CVE-2026-88771 [CRITICAL] September 2026 CVE Landscape
## September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and m
Krebs
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
blogs_krebs·2026-10-07·CVSS 9.8
CVE-2026-35273 [CRITICAL] ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “ Rey ,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing , which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines .
The logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing.
On October 3, Reuters cited three unnamed sources saying a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities
Hackernews
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
blogs_hackernews·2026-10-06·CVSS 9.8
CVE-2026-35273 [CRITICAL] FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees.
That's according to a report from Reuters, citing two sources familiar with the matter.
"To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform," Br
Hackernews
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation
blogs_hackernews·2026-09-29
CVE-2026-35273 Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation
Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group.
"It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," the Politie Landelijke Opsporing en Interventies said in an X post Monday.
Police said the individual is expected to appear before the Rotterdam District Court on September 29, 2026.
Although law enforcement officials did not disclose any additional details, independent security journalist Bria
Krebs
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
blogs_krebs·2026-09-28
CVE-2026-35273 Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters . In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p .
According to three sources familiar with the matter, the Dutch man arrested by authorities this month is Pepijn van der Stap , a convicted cybercriminal from Almere and Lelystad in the Netherlands. Van der Stap was previously convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million.
At his trial in late 2023, va
Hackernews
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
blogs_hackernews·2026-09-26·CVSS 9.8
CVE-2026-35273 [CRITICAL] Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally.
The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.
The vulnerability was first exploited as a zero-day in attacks against academic institutions to conduct reconnaissance, deploy remote access software like MeshCentral agent for persistence, move laterally over
Hackernews
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
blogs_hackernews·2026-09-23
CVE-2026-35273 ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.
"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark web site. "Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medl
Securelist
Exploits and vulnerabilities in Q2 2026
blogs_securelist·2026-08-26·CVSS 8.8
CVE-2026-25253 [HIGH] Exploits and vulnerabilities in Q2 2026
Alexander Kolesnikov
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
LLM/AI tool vulnerabilities
Notable vulnerabilities
CVE-2026-25253: a gatewayUrl vulnerability in OpenClaw
CVE-2026-41948: a path traversal vulnerability in the Dify AI platform
CVE-2026-45386: an improper access control vulnerability in Open WebUI
CVE-2026-45501: a vulnerability in Microsoft Exchange
Conclusion and advice
Authors
Alexander Kolesnikov
The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, bot
Hackernews
ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
blogs_hackernews·2026-07-16
CVE-2026-46817 ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
A lot of this week’s trouble starts with something that looks close enough.
A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation.
Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess.
Cybersecurity researchers 11 malicious NuGet packages published as .NET command-line tools that present themselves as game utilities, bots, and
Hackernews
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
blogs_hackernews·2026-06-30·CVSS 9.8
CVE-2026-46817 [CRITICAL] Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber.
The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances.
"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments," according to a description of the flaw in the NIST National Vulnerability Database (NVD
Tenable
Oracle June 2026 Critical Security Patch Update Addresses 243 CVEs (CVE-2026-35273)
blogs_tenable·2026-06-18·CVSS 9.8
CVE-2026-35273 [CRITICAL] Oracle June 2026 Critical Security Patch Update Addresses 243 CVEs (CVE-2026-35273)
## Oracle June 2026 Critical Security Patch Update Addresses 243 CVEs (CVE-2026-35273)
Oracle addresses 243 CVEs in its June 2026 Critical Security Patch Update with 245 patches, including 122 critical updates.
## Key Takeaways
The June 2026 Critical Security Patch Update (CSPU) contains fixes for 243 unique CVEs in 245 security updates
122 issues (49.8% of all patches) were assigned a critical severity rating
Oracle Fusion Middleware received the highest number of patches at 106, accounting for 43.3% of all patches
## Background
On June 16, Oracle released its Critical Security Patch Update (CSPU) for June 2026 . Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of
Checkpoint
15th June – Threat Intelligence Report
blogs_checkpoint·2026-06-15·CVSS 9.8
CVE-2026-35273 [CRITICAL] 15th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 15th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
The University of Nottingham, a UK research university, has suffered a data breach after ShinyHunters accessed its student records system. The incident affected about 454,600 current and former students and exposed contact details, passport numbers, enrollment information, and fee payment records later appeared online. According
Hackernews
⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
blogs_hackernews·2026-06-15·CVSS 8.8
CVE-2026-11645 [HIGH] ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod.
This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else's entry point.
Scroll through the full Monday Cybersecurity Recap below for the news, tools, webinars, and fixes worth your time this week.
## ⚡ Threat of the Week
Google Patches Actively Exploited Chrome 0-Day - G
Rapid7
Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
blogs_rapid7·2026-06-12·CVSS 9.8
CVE-2026-35273 [CRITICAL] Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
## Overview
On June 10, 2026, Oracle published a security alert for CVE-2026-35273 , a critical vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. Oracle released an out-of-band patch the same day as the advisory, underscoring the urgency of remediation. The vulnerability has a CVSSv3.1 score of 9.8 and is remotely exploitable without authentication. Per the vendor advisory, successful exploitation may result in remote code execution (RCE). TrendAI has classified the underlying flaw as a server-side request forgery ( CWE-918 ). PeopleTools versions 8.61 and 8.62 are affected.
CVE-2026-35273 was reported to Oracle through TrendAI's Zero Day Initiative. According to a report published by Mandiant on June 11, 2026, this vulnerability has been
Hackernews
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
blogs_hackernews·2026-06-12·CVSS 9.8
CVE-2026-35273 [CRITICAL] ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand payment to keep it private. The campaign hit universities hardest.
Google's Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9. Oracle did not publish its advisory until June 10, so the bug was a zero-day the entire time.
The flaw, CVE-2026-35273 , is a remote code execution bug in PeopleSoft Enterprise PeopleTools rated 9.8 out of 10. It needs n
Mandiant
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
blogs_mandiant·2026-06-11·CVSS 9.8
CVE-2026-35273 [CRITICAL] ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
## ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
## Mandiant
## Introduction
Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273 , a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints. Because this activity predates Oracle's June 10, 2026 advisory, the vulnerability was exploited as a zero-day.
Upon becoming aware o
Bleepingcomputer
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
blogs_bleepingcomputer·2026-06-11·CVSS 9.8
CVE-2026-35273 [CRITICAL] Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
## Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
## Lawrence Abrams
Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks.
The flaw is within Oracle PeopleSoft PeopleTools and has a CVSS base score of 9.8.
"This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability," reads a new Oracle advisory.
"This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution."
Oracle has confirmed that th
Threat Intel
ShinyHunters (ShinyHunters, UNC6240, Bling Libra)
threat_intel
CVE-2026-35273 ShinyHunters (ShinyHunters, UNC6240, Bling Libra)
# Threat Actor Profile: ShinyHunters
ATT&CK ID: G1057
Also known as: ShinyHunters, UNC6240, Bling Libra
## Overview
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hun
2026-06-11
Published
2026-06-12
Added to CISA KEV
Exploited in the wild