Oracle PeopleSoft zero-day (CVE-2026-35273) exploited in the wild before patch

TLDR

• ZDI reported three distinct PeopleSoft vulnerabilities; Oracle patched them under one CVE, CVE-2026-35273, and separate CVEs are being sought.³
• An SSRF in PSIGW reaches PSEMHUB via default localhost trust; file-write and deserialisation bugs then enable code execution.³
• Mandiant ties 27 May to 9 June exploitation to ShinyHunters; The Register says patching may not remove attackers already inside.⁶⁵

On 10 June 2026, Oracle published a security alert and out-of-band patch for CVE-2026-35273, a critical flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools, rated CVSS 9.8, remotely exploitable without authentication and capable of remote code execution.¹ A Mandiant report published 11 June 2026 found the vulnerability had already been exploited in the wild as a zero-day before the vendor alert, with observed activity running between 27 May and 9 June 2026.¹

Update, what changed: attackers have since modified their exploit of that same CVE-2026-35273 to bypass the WAF protections put in place after the original alert, rather than exploiting a new vulnerability.² The attackers, tracked as UNC6240, request "/%50SEMHUB/" in place of "/PSEMHUB/", replacing the letter P with its URL-encoded form so that WAF and reverse proxy rules, which typically match the literal path before decoding, see a harmless-looking string while PeopleSoft's own server still decodes and routes the request correctly.² From there, they send a POST request containing a serialised Java object, abusing Java deserialisation in the PSEMHUB hub servlet to run code without dropping a file to disk.²

The chain has since escalated to include two JSP web shells for command execution and file uploads, a signed but trojanised installer that loads a new C++ backdoor called SIDEEYE with credential theft, reverse shell and reverse proxy capabilities, and use of the Neo-reGeorg tunnelling toolkit and the legitimate MeshAgent remote monitoring tool for persistence.² Web shells have been deployed across dozens of systems spanning higher education, technology, IT services, healthcare, agriculture, transportation and government, with roughly a quarter of observed commands running with root or SYSTEM privileges.²

ShinyHunters, the extortion focused group UNC6240 is linked to, separately claims to have breached the FBI's jobs portal using a different, unspecified PeopleSoft zero-day and stolen 2 to 3 terabytes of data, though the group says this was not financially motivated and that claim has not been independently verified here.²

Update, 29 October 2026: TrendAI's Zero Day Initiative (ZDI) says the PeopleSoft flaw that Oracle patched as CVE-2026-35273 is three distinct vulnerabilities rather than one, and that it is coordinating with Oracle to assign separate CVEs.³ ZDI says it first reported the CVE to Oracle on 10 June 2026, following an investigation by Bobby Gould, Minh Giang and Lucas Miller, and that Oracle issued a patch under a single CVE although ZDI reported three vulnerabilities across multiple PeopleSoft components.³ Oracle's security alert credits the same three researchers, lists only CVE-2026-35273 (CVSS 3.1 base score 9.8, PeopleTools 8.61 and 8.62, remotely exploitable without authentication), and its modification history shows only the initial release on 10 June 2026.⁴ The Hacker News and The Register both report the three-bug breakdown, and The Hacker News says the single June identifier is still the only one on the record.⁵⁶

ZDI describes the chain in three parts.³ The first is a server-side request forgery (SSRF) in the PeopleSoft Integration Gateway (PSIGW), where an attacker controls both the target URL and the full payload and the handler does not check that the destination is legitimate.³ The Environment Management Hub (PSEMHUB) restricts clients with a validateClient check against allowedhosts.properties, which ships with localhost on the list, so pointing the SSRF at 127.0.0.1 satisfies it.³ The second is an external control of file path flaw in the PSEMHUB ExecuteProcessActivityCommand handler, which lets the caller choose both the content and the absolute path written, allowing a web shell to run as the PeopleSoft service account.³ The third is deserialisation of untrusted data in PSEMHUB: with any file-write primitive, an attacker can plant an XML file that is deserialised with XMLDecoder when the hub servlet next initialises, for example after a restart, which ZDI says is less likely to be noticed by standard detection because no JSP web shell is needed.³

On attribution, The Hacker News reports that Mandiant and Google Threat Intelligence Group tie exploitation between 27 May and 9 June to UNC6240, better known as ShinyHunters, mostly against universities, and that a September wave used the /%50SEMHUB/ WAF bypass.⁶ ZDI's post refers to Mandiant's 25 September report on continued mass exploitation by ShinyHunters.³ The Register reports that Gould says each bug should receive its own CVE rather than being grouped under CVE-2026-35273, and that patching alone may not remove attackers from already compromised systems, particularly if they have installed web shells.⁵ The Hacker News adds that Oracle's alert does not address whether patching removes access an attacker already has.⁶

Why it matters: ZDI describes three chained bugs behind a single CVE, and The Register says patching alone may not remove attackers who already installed web shells.³⁵