ShinyHunters Exploited Three-Flaw Oracle PeopleSoft Chain for Unauthenticated RCE

Technical analysis from Zero Day Initiative reveals that CVE-2026-35273, exploited by ShinyHunters and tracked under UNC6240, covers three chained Oracle PeopleSoft vulnerabilities enabling unauthenticated remote code execution in PeopleTools 8.61 and 8.62. Server-side request forgery in the Integration Gateway lets attackers reach the Environment Management Hub through localhost, bypassing its default host-based access restrictions. An arbitrary file-write vulnerability then allows deployment of a JSP web shell or malicious XML that triggers code execution through unsafe deserialization when the hub initializes. Oracle patched the chain under a single CVE; researchers are coordinating separate CVE assignments for the three issues.

Oracle released the patch on June 10, 2026, after exploitation had already targeted predominantly universities. A larger September campaign affected dozens of systems across multiple sectors, with attackers using URL encoding to bypass path-based web application firewall rules; Mandiant reported continued mass exploitation on September 25. Organizations should apply Oracle’s patch promptly, disable or remove the vulnerable management component if patching is delayed, and investigate exposed systems for existing compromise. Patching alone does not remove web shells or other access attackers may have established.