ShinyHunters exploits Oracle PeopleSoft zero-day CVE-2026-35273 for RCE

1. Executive summary

ShinyHunters (MITRE G1057) exploited CVE-2026-35273, a critical Oracle PeopleSoft flaw (CVSS 9.8, CWE-306), as a zero-day from as early as May 2026, and Mandiant reports the group has since deployed web shells on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government. CVE-2026-35273 is in CISA KEV (added 2026-06-12) with EPSS at 97%, so exploitation is both confirmed and near-certain in the wild. Separately, attackers are probing CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite (CVSS 9.8, CWE-287 and CWE-306), which is not in KEV and carries EPSS of 1%. EMEA financial services firms running PeopleSoft or EBS in HR, payroll, procurement or finance functions should treat PeopleSoft as actively compromised-capable and EBS as under active reconnaissance.

2. Regulatory framing

3. Technical analysis & attack chain

The PeopleSoft exploitation chain combines three distinct vulnerabilities that ZDI and TrendAI reported to Oracle in June 2026 and that Oracle patched under a single identifier, CVE-2026-35273. ZDI's Bobby Gould, with TrendAI researchers Minh Giang and Lucas Miller, states the three should carry separate CVE identifiers and is coordinating with Oracle to assign them. The confirmed chain:

1. Server-side request forgery in the PeopleSoft Integration Gateway (PSIGW). Oracle's June fix introduced a validateClient method so administrators can restrict access to certain functionality. Gould states an attacker on any trusted host can still reach PSEMHUB, and because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access. The SSRF lets the attacker make requests that satisfy the validation requirement and reach endpoints vulnerable to RCE.
2. External control of file path in PSEMHUB's ExecuteProcessActivityCommand handler. The handler is designed to let remote clients write log entries to the PeopleSoft server filesystem but does not properly validate requests, so an attacker can write a web shell to a chosen file path and achieve RCE.
3. Deserialization of untrusted data in PSEMHUB. Using the file-write flaw, the attacker plants a malicious XML file in the PeopleSoft directory that stores environment configuration data, then waits for PSEMHUB to initialize (for example after a service or system restart). Initialization triggers deserialization of the malicious XML, potentially yielding RCE.

Mandiant confirmed ShinyHunters exploited CVE-2026-35273 as a zero-day, initially mostly against schools and the education sector, then expanded to the sectors listed in §1 with web shells on dozens of systems. ShinyHunters told The Register in early June that it had hacked more than 100 organizations via the PeopleSoft zero-day. Mandiant characterised the group as a data theft and extortion crew; the sources do not describe ransomware deployment.

Patching alone may not remove attackers from already compromised systems, particularly where web shells were installed. The sources do not give web shell filenames, paths, command-and-control infrastructure or exfiltration tooling, so no atomic indicators can be derived from them.

The second issue in the item is CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework servlet. Horizon3 found and disclosed it, and Oracle patched it in the October release. Horizon3 states an attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user, and the chain also enables OS command execution with the privileges of the EBS application account. Affected data may include financial, payroll, HR and procurement records. Defused Cyber reported on 27 October that its EBS decoys recorded exploratory exploits against CVE-2026-101767. Oracle had not responded to The Register's questions on documented successful exploitation at time of publication.

Confidence caveats: the three-vulnerability decomposition of CVE-2026-35273 rests on the ZDI/TrendAI blog as reported by The Register (single-sourced; the separate CVE identifiers are not yet assigned). The ShinyHunters victim count of more than 100 organizations is the group's own claim to The Register, not independently corroborated in these sources. The Defused Cyber decoy observation of EBS probing is a single vendor's honeypot telemetry.

4. Mitigation & containment

P1 (within 24 hours)

• Confirm whether CVE-2026-35273 is patched on every PeopleSoft instance. It is in CISA KEV with EPSS 97%; treat any unpatched instance as exposed. Apply the Oracle patch issued under CVE-2026-35273.
• Hunt for web shells on PeopleSoft servers. Mandiant reports web shells on dozens of systems; patching does not remove them. Review the PeopleSoft filesystem, especially directories writable via the ExecuteProcessActivityCommand handler, for unexpected executable or script files.
• Restrict network access to PSIGW and PSEMHUB. Because Oracle allows localhost by default and the SSRF relies on that trust, block external and untrusted-host reachability to PSEMHUB and review the validateClient configuration introduced in June.
• For EBS running CVE-2026-101767-affected versions, apply the October Oracle patch. Until applied, restrict access to the Thin Client Framework servlet at the network edge.

P2 (within 72 hours)

• Review PeopleSoft environment configuration directories for unauthorised XML files, since the deserialization step depends on a planted XML file being processed at PSEMHUB initialisation. Compare against a known-good baseline.
• Audit the APPS database user's reach in EBS and the EBS application account's OS command privileges; both are the stated impact paths for CVE-2026-101767.
• Check PeopleSoft and EBS logs for anomalous requests to PSIGW, PSEMHUB and the Thin Client Framework servlet, and for service or system restarts that could have triggered deserialization.

P3 (within 7 days)

• Track Oracle's assignment of separate CVE identifiers for the three PeopleSoft issues and re-verify patch coverage against each once published.
• Add PeopleSoft and EBS components to third-party patch tracking under DORA Art. 28, including the customer-side configuration controls (validateClient, localhost trust) that the vendor patch does not fully close.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe the exploitation mechanism and affected components but give no hashes, domains, IP addresses, file paths or web shell names.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules. The sources name components and handlers (PSIGW, PSEMHUB, ExecuteProcessActivityCommand, Thin Client Framework servlet) but give no distinctive strings, command lines, filenames, registry keys or other artefacts of the threat itself from which a reliable rule could be built. Rules keyed on component or CVE names would detect reporting about the threat, not the threat.

CVE assessment

2 referenced CVEs — 1 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

7. Sources

• The Register, "Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble", https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121, 2026-10-28.
• NVD, CVE-2026-35273 (CVSS 9.8, CWE-306), https://nvd.nist.gov/vuln/detail/CVE-2026-35273.
• NVD, CVE-2026-101767 (CVSS 9.8, CWE-287, CWE-306), https://nvd.nist.gov/vuln/detail/CVE-2026-101767.
• CISA KEV catalog, CVE-2026-35273 added 2026-06-12, https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
• MITRE ATT&CK, ShinyHunters, G1057, https://attack.mitre.org/groups/G1057/.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-35273 as the higher priority of the two: it is in CISA KEV, EPSS is 97%, ShinyHunters (G1057) is confirmed to have exploited it as a zero-day, and Mandiant reports web shells on dozens of systems, so patching alone will not clear a compromised estate. CVE-2026-101767 is CVSS 9.8 but not in KEV and EPSS is 1%; the current signal is exploratory probing against decoys, which warrants edge restriction and patching but not incident-scale response on its own. The three-vulnerability decomposition of CVE-2026-35273 is single-sourced to ZDI/TrendAI and the separate CVE identifiers are not yet assigned, so clients should not wait for them before patching. We will track Oracle's CVE assignment for the three PeopleSoft issues and update this advisory when identifiers and any vendor-published indicators are available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.