ShinyHunters exploits chained Oracle PeopleSoft SSRF CVE-2026-35273

1. Executive summary

ShinyHunters (MITRE G1057) exploited CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools as a zero-day from 27 May 2026, before Oracle issued an out-of-band patch on 10 June 2026. The flaw is rated CVSS 9.8 critical, is recorded as CWE-306 (missing authentication for a critical function), carries an EPSS of 97%, and was added to CISA KEV on 12 June 2026. Researchers now describe the bug as three chained flaws rather than one: a server-side request forgery that reaches an internal management interface because PeopleSoft trusts its own loopback address, with code execution as the outcome. Mandiant reported more than 100 notified organisations, 68% of them universities and colleges, and ShinyHunters claimed over 300 vulnerable instances; the University of Nottingham confirmed a breach with 40 GB of student and billing data published after it refused the extortion demand. EMEA financial services running PeopleTools 8.61 or 8.62 should treat this as an active, internet-reachable path to unauthenticated code execution and data theft, not a patching backlog item.

2. Regulatory framing

3. Technical analysis & attack chain

The chain runs from an unauthenticated HTTP request to the PeopleSoft Environment Management Hub through to code execution and data theft. Mandiant describes CVE-2026-35273 as critical remote code execution; TrendAI classifies the underlying flaw as server-side request forgery (CWE-918), and the NVD records CWE-306 (missing authentication for a critical function). Both describe the same flaw: the SSRF reaches an internal management interface because PeopleSoft trusts its own loopback address, and the missing authentication on that interface is what lets the request through.

1. The attacker sends an unauthenticated HTTP request to the PeopleSoft Environment Management Hub endpoint /PSEMHUB/hub. No credentials are required (CVSS 9.8, network reachable).
2. The request triggers a server-side request forgery. Because PeopleSoft trusts its own loopback address, the SSRF reaches an internal management interface that should not be externally reachable.
3. The chain, now described as three flaws under one identifier, results in remote code execution on the PeopleTools host.
4. Post-exploitation, Mandiant observed deployment of MeshCentral remote management agents, internal reconnaissance of PeopleSoft configurations, lateral movement scripts, and data exfiltration using zstd compression.

Affected versions are PeopleTools 8.61 and 8.62. The second endpoint in the exploitation path is /PSIGW/HttpListeningConnector. The exploit chain may also cause the target to make outbound SMB connections (TCP port 445) to external destinations, which can let an attacker capture Windows machine-account NetNTLM hashes.

The MeshCentral agents were configured to masquerade as Microsoft Azure services, for example meshagent64-azure-ops.exe, with command-and-control to wss://azurenetfiles[.]net:443/agent.ashx. TrendAI detection signatures for the flaw are IPS Rule 1012580 ("Oracle Peoplesoft PeopleTools SSRF Vulnerability") and DDI Rule 5855 ("Peoplesoft PeopleTools Environment Management Hub (PSEMHUB) SSRF Exploit").

Timeline and attribution. Mandiant reported active exploitation between 27 May and 9 June 2026, two weeks before Oracle's 10 June advisory and same-day out-of-band patch. Data stolen in the campaign was published on the ShinyHunters data leak site on 9 June 2026. ShinyHunters told The Register it compromised more than 100 organisations across 300 vulnerable instances and stole 40 GB from the University of Nottingham; the 68% higher-education share and the 100-plus notified organisations come from Mandiant. The ShinyHunters attribution to this campaign rests on Mandiant's reporting (UNC6240) and the group's own claims; the MITRE G1057 profile is the group-level mapping, not a per-incident confirmation. Treat the specific victim count and the 300-instance figure as single-sourced to the actor's own claim.

Confidence caveat. The three-flaw characterisation and the loopback-trust mechanism come from the researchers who reported the bug, as relayed in the 28 October reporting; the detailed post-exploitation behaviour (MeshCentral, NetNTLM capture, zstd exfiltration) is single-sourced to Mandiant. Verify endpoint and tooling specifics against your own telemetry before enforcing blocks.

4. Mitigation & containment

P1 (within 24h)

• Patch PeopleTools 8.61 and 8.62 with Oracle's out-of-band fix for CVE-2026-35273 on an emergency basis, outside the normal patch cycle. Oracle characterised this as a high-priority risk reduction measure.
• Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter and WAF. Note that attackers have bypassed WAFs in this campaign, so treat the block as defence in depth, not the fix.
• Disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations.
• Hunt for outbound SMB (TCP 445) from PeopleSoft hosts to external destinations, and for MeshCentral agent binaries such as meshagent64-azure-ops.exe and connections to azurenetfiles[.]net.

P2 (within 72h)

• Search PeopleSoft and web logs for requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector from unexpected sources, and for the SSRF-induced loopback requests.
• Review PeopleSoft host configurations for signs of internal reconnaissance and lateral movement scripts.
• If compromise is suspected, preserve evidence and assess for data exfiltration (zstd-compressed archives leaving the host).

P3 (within 7 days)

• Confirm no remaining PeopleTools 8.61/8.62 instances are internet-exposed without the patch and the endpoint blocks.
• Add the TrendAI signatures (IPS 1012580, DDI 5855) to detection coverage if the platform supports them.

5. Indicators of compromise

url  hxxps://azurenetfiles[.]net:443/agent.ashx
domain  azurenetfiles[.]net
filename  meshagent64-azure-ops.exe
uri  /PSEMHUB/hub
uri  /PSIGW/HttpListeningConnector

The network and file indicators are single-sourced to Mandiant; verify before enforcement. The two URI paths are the exploitation endpoints and are corroborated across the reporting.

Behavioural indicators:

6. Detection

rule MeshCentral_Azure_Masquerade_Agent
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-28"
        reference = "https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273"
        description = "Detects MeshCentral agent masquerading as an Azure service, as deployed in ShinyHunters PeopleSoft campaign"
    strings:
        $fname = "meshagent64-azure-ops.exe" ascii wide
        $c2 = "azurenetfiles.net" ascii wide
        $path = "/agent.ashx" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: PeopleSoft Environment Management Hub SSRF Exploitation Attempt
id: 8f3c2a1e-people-soft-ssrf
status: experimental
author: Adverse Trace
date: 2026-10-28
references:

  - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|startswith:

      - '/PSEMHUB/hub'
      - '/PSIGW/HttpListeningConnector'
  condition: selection
falsepositives:

  - Legitimate administrative access to the Environment Management Hub from trusted internal sources
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

7. Sources

• The Hacker News, "ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws", https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html, 2026-10-28.
• Rapid7 Blog, "Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)", https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273.
• BleepingComputer, "Oracle mitigates PeopleSoft zero-day exploited in data theft attacks", https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/.
• SecurityWeek, "Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks", https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/.
• The Hacker News, "Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells", https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html.
• The Record, "ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns", https://therecord.media/shinyhunters-cyberattacks-oracle-mandiant.
• The Register, "ShinyHunters claims it hacked 100 orgs by exploiting an Oracle PeopleSoft 0-day", https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443, 2026-06-11.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-35273 as CVSS 9.8 critical, in CISA KEV since 12 June 2026, with an EPSS of 97%, and actively exploited by ShinyHunters (MITRE G1057) against internet-reachable PeopleTools 8.61 and 8.62. The exploitation is confirmed and the patch is available; the residual risk for EMEA financial services is unpatched or internet-exposed instances and the data-theft outcome, not the SSRF mechanism itself. The three-flaw characterisation and the post-exploitation tooling are single-sourced to the reporting researchers and Mandiant respectively, so we will treat the MeshCentral and NetNTLM details as indicators to hunt for rather than confirmed across all victims. We will track further reporting on the chained flaws and update this advisory if the exploitation picture changes. Clients should confirm patch status and endpoint blocks for PeopleTools 8.61/8.62 and report suspected compromise to Adverse Trace for triage.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.