ShinyHunters confirmed behind PeopleSoft CVE-2026-35273

Oracle has disclosed a flaw in PeopleSoft — the HR and payroll system widely used by large enterprises, universities, and governments — that lets an attacker take over the server completely without logging in, and has shipped an emergency fix without waiting for its quarterly patch cycle. It is tracked as CVE-2026-35273, rated at the top of the scale, CVSS 9.8 (Critical). No authentication and no user interaction are required; it reaches remote code execution straight over the network.

Oracle normally bundles fixes into a quarterly Critical Patch Update. This time it did not wait, publishing a standalone emergency Security Alert dated June 10, 2026. Oracle issuing an out-of-cycle alert is unusual, and that fact alone speaks to the severity. Oracle itself urges immediate action in unusually strong terms.

Just as notable is that, at almost the same time, there are reports that the threat group "ShinyHunters" is stealing large volumes of data from PeopleSoft servers. More than 100 organizations and some 300 systems are said to be targeted, mostly universities and educational institutions. That campaign has since been confirmed by Mandiant and Google Threat Intelligence Group as exploitation of CVE-2026-35273 (detailed in the next section). Any organization running the affected system should patch now.

[Update, August 12] The root-cause dispute is settled. But the circulating victim lists contain errors

Two weeks on from the July 29 update, no new breach disclosures and no additional patch have appeared. What did move is the resolution of two things that had been murky.

Confirmed: SSRF is the way in, deserialization is what executes

Coverage of this flaw kept describing it either as SSRF (tricking a server into making internal requests on the attacker's behalf) or as a deserialization bug (a flaw in how data is rebuilt into program objects), which left readers unsure which it was. Trend Micro's technical write-up resolves it as a multi-stage chain.

The entry point is SSRF. Through an externally exposed integration endpoint, the attacker reaches a component that should only be reachable from inside. What actually executes is deserialization: malicious XML is rebuilt into objects inside the application server's JVM. The awkward part is that this payload is designed to fire when the server restarts. Nothing happens at the moment of attack, which is exactly what makes it hard to spot afterwards.

So it was never "SSRF or deserialization" — both happen, in sequence. The formal classification remains split, however: NIST and the U.S. government's exploited-vulnerability catalog still file it as missing authentication for a critical function (CWE-306).

Credit for the discovery is now confirmed in the credit statement of Oracle's emergency alert: Bobby Gould, Lucas Miller, and Minh Giang. No public proof-of-concept has been found as of August 12.

The victim lists going around include companies that do not belong

This needs care. Since early July, roundups have circulated that list Kubota North America and Aflac Japan among the victims of this flaw. We are not adopting that. Cross-checked against closer-to-primary reporting, the dates do not line up.

Both remain serious incidents, but there is no corroboration that this flaw caused either. The likelier explanation is that the roundups bundled separate incidents that happened around the same time. The breaches we continue to attribute to this flaw are Nissan, NAIC, and the University of Nottingham. No new disclosures from higher education have surfaced as of August 12 either.

"Permanently fixed in the July quarterly patch" is also not accurate

One more phrase worth correcting: reporting that says the July Critical Patch Update delivered the permanent fix. Oracle's emergency alert has not been revised once since its June 10 initial release, and the identifier does not appear anywhere in the July CPU text. The real fix is the June 10 alert plus the June 16 security patch update. Because a CPU rolls up earlier fixes, applying July's does include it — which is all that phrasing means. It is not something an unpatched organization should be waiting for.

[Update, July 29] Attribution confirmed to ShinyHunters; Nissan and NAIC disclose breaches

The biggest open question in this article — whether the ShinyHunters attacks actually used CVE-2026-35273 — is settled. On June 11, 2026, Mandiant and Google Threat Intelligence Group confirmed zero-day exploitation of CVE-2026-35273 by ShinyHunters, which Google tracks as UNC6240. The observed exploitation window runs from May 27 to June 9, 2026 — before Oracle's June 10 emergency alert. Google notified more than 100 organizations of potential exposure, and 68% of them were in higher education. Stolen data was published on the ShinyHunters leak site on June 9.

Post-intrusion, the attackers ran customized MeshCentral agents from staging infrastructure masquerading as legitimate cloud endpoints, using them to issue administrative commands and to deploy a custom lateral-movement and defacement script (The Hacker News). This was not a smash-and-grab data pull; they built a foothold.

Victim disclosures have started to land. Nissan Americas disclosed an employee data breach on June 29, 2026, tied to exploitation of this flaw, affecting current and former employees in the U.S., Canada, Mexico, and Brazil — with Social Security numbers and bank account details among the data at risk. On the same day, the National Association of Insurance Commissioners (NAIC) also acknowledged a breach. Both are broken down in the "Organizations that disclosed a breach" section below.

The technical picture also filled in. Oracle still withholds the internals, but Rapid7 published the root cause as SSRF (CWE-918) leading to RCE, along with the two exploited endpoints and concrete mitigations. That gives defenders something to do while patching is scheduled, so it has been added to the technical section.

One claim circulating in some outlets — that ShinyHunters chained CVE-2026-35278 with this flaw to achieve pre-auth RCE — could not be verified. Mandiant, Rapid7, and SecurityWeek all describe CVE-2026-35273 alone, and NVD and CISA-ADP list no known public exploitation for CVE-2026-35278. This article does not adopt that claim.

[Update, June 13] CISA Adds It to the "Exploited" List, With a June 15 Federal Deadline

After this article was published, the situation moved sharply. On June 12, 2026, CISA — the cybersecurity arm of the U.S. Department of Homeland Security — added CVE-2026-35273 to its catalog of vulnerabilities under active attack (KEV: Known Exploited Vulnerabilities). That officially confirms the point this article had originally marked as "unconfirmed": whether this flaw is being exploited in the real world.

CISA classified it as "Missing Authentication for Critical Function" and set an extremely short remediation deadline for U.S. federal agencies of June 15, 2026. Giving agencies only a few days after listing is how CISA responds when it judges the risk high and the response urgent. CISA also explicitly marked the flaw as known to be used in ransomware campaigns (known ransomware campaign use: Known). The link between the ShinyHunters data theft and this CVE was in fact already established a day earlier, in Mandiant's June 11 analysis (see the update at the top of this article).

The conclusion for defenders does not change, but the priority should be raised to the top. Private companies and organizations in Japan are not bound by a legal deadline like federal agencies, but the shift from "theoretical" risk to "actively attacked" is significant. Any organization running PeopleTools 8.61/8.62 should treat applying Oracle's emergency patch as the highest-priority task and do it immediately. You can also track the latest KEV listings on our CISA KEV dashboard.

What PeopleSoft is, and why a takeover is so dangerous

PeopleSoft is a large-scale enterprise resource planning (ERP) system that Oracle acquired in 2005. It handles HR, payroll, time and attendance, finance and accounting, procurement, and university administration (Campus Solutions) on a single platform, and large enterprises, universities, and government agencies entrust their core organizational data to it. In Japan, too, it runs at major firms and universities — Toyota's adoption of PeopleSoft for HR and payroll is a well-known case.

Here is what makes it matter: PeopleSoft is where an organization's most sensitive data is concentrated. Every employee's and student's name, address, salary, bank account, performance review, and social-security-related information sits in one place. Take over that platform and an attacker can read all of it, and — because they can run arbitrary programs on the server — rewrite data, pivot to other systems, and deploy ransomware in one continuous motion. In security terms, confidentiality, integrity, and availability all collapse at once: the worst possible combination.

What makes this flaw especially heavy is that the takeover needs no valid ID or password. If the affected function is exposed where the internet can reach it, an intruder gets in before the login screen. A past survey found over 500 PeopleSoft systems exposed directly to the internet worldwide, many of them universities, showing that a meaningful number of easy targets exist for attackers.

Is your organization affected? Check the version

Oracle's alert names specific versions of "PeopleTools," the foundation software of PeopleSoft. Organizations running PeopleSoft applications on top of PeopleTools (HCM for HR, Financials, Campus Solutions, and so on) are affected depending on that foundation's version.

The faulty component is "Updates Environment Management." It appears to correspond to PeopleSoft's Environment Management Framework, which handles environment management and patch distribution. Because it runs as a component on the web server, it tends to be reachable from outside. Start by inventorying your PeopleTools version and how far the relevant function is exposed externally.

Who comes through this hole first, and what do they carry off

Oracle breaking from its quarterly cycle to ship a standalone patch is unusual, and that itself is a signal: this is not a hole you can sit on. Here is what happens from the attacker's side. The prerequisite is shockingly light — deliver a single request to the affected function over the network, and that is all.

The people coming for it are not vague "hackers." They are extortion crews that ransom stolen data (ShinyHunters, confirmed to have exploited this CVE, is exactly this), initial-access brokers who resell entry points to companies at a premium, and buyers who want the HR records of universities and enterprises as a product in themselves. What they take is every employee's and student's name and address, salary figures, bank accounts, performance reviews, social-security-related numbers, and the doorway into the finance system. The instant a single HTTP request reaches this component from in front of the login screen, that HR server — contents and all — passes into their hands.

Technically, this is a pre-authentication intrusion that does not even require impersonating a legitimate user, and after entry the attacker can run arbitrary programs on the server. So the first step becomes a foothold inside the organization, from which they pivot to other systems and ultimately seize the whole network. The ShinyHunters campaign targeted more than 100 organizations and some 300 systems, causing real damage centered on educational institutions. The more the attack surface is the "heart of HR," the more a single breach echoes across the whole organization.

The number CVSS 9.8 is just a label for the maximum technical severity. For the universities and enterprises that have trusted PeopleSoft as the foundation of HR, payroll, and student records, what is truly lost is the life records of every employee and student — salary, accounts, addresses, evaluations — carried off all at once, without even forcing a login. Lose the center of your defenses, and every individual hanging off it falls within the attacker's reach.

A technical look at CVE-2026-35273: where and what goes wrong

CVE-2026-35273: unauthenticated remote code execution that takes over PeopleTools

The CVSS vector for CVE-2026-35273 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is over the network (AV:N), low in attack complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), and results in severe impact to confidentiality, integrity, and availability (C:H/I:H/A:H). Full compromise, reached remotely and unattended from before authentication, is the worst combination on the scale — and that is where the 9.8 comes from.

The faulty component, "Updates Environment Management," is the mechanism that aggregates the state of each PeopleSoft environment (development, test, production) and distributes patches and settings. Because it runs as a web app on the web server (PeopleSoft Internet Architecture), it is reachable from the network — which fits the "no authentication, over HTTP" conditions here. Oracle's alert does not disclose the flaw's internal mechanics (what processing defect leads to code execution). This is customary, to avoid making the attack easy to reproduce. Third-party analysis has since filled in the root cause and the attack paths, covered below. The discoverer is reported to be a researcher at Trend Zero Day Initiative (ZDI), though we could not officially confirm the credit at the time of writing.

Root cause and attack paths, as published by third parties

Rapid7's analysis classifies the root cause as server-side request forgery (CWE-918): a defect that makes the server issue requests of the attacker's choosing, which then serves as the mechanism through which code execution is reached. Per Mandiant's analysis, two endpoints are involved in exploitation: /PSEMHUB/hub and /PSIGW/HttpListeningConnector. Naming of the root cause varies across outlets — some describe it as insecure deserialization in /PSEMHUB/hub. This article follows Rapid7's CWE-918 classification.

What matters operationally are the mitigations Rapid7 published alongside it. Even where a patch window cannot be arranged immediately, these are actionable today.

Do not skip the outbound SMB monitoring. The exploit chain can make the target server open SMB connections to external destinations, letting attackers capture Windows machine-account NetNTLM hashes. That turns an HR server takeover into a path toward the domain. A PeopleSoft server has essentially no legitimate reason to reach port 445 on the internet, so the detection rule is clean and cheap.

Attacker infrastructure has also been published: Horizon3.ai listed 142.11.200[.]186-190, 108.174.202[.]99, and 176.120.22[.]24 as IPs used in the campaign, useful for retrospective log hunting. These are infrastructure indicators, not a public proof-of-concept. Whether working PoC code is publicly circulating remains unconfirmed.

PeopleSoft has repeatedly had externally reachable flaws — unauthenticated file reads (CVE-2023-22047) and remote code execution from improper data handling (CVE-2025-30748). There is no confirmed technical link between CVE-2026-35273 and those past cases, but the pattern is shared: a high-value HR platform whose pre-authentication attack surface keeps getting targeted. Among Oracle products, there is also a case where a WebLogic Server flaw was actively exploited and CISA ordered urgent remediation, so it is wise to assume "Oracle's foundation products are a priority target for attackers."

Organizations that disclosed a breach, and what actually got out

The abstract "100+ organizations targeted" is turning into named victims. Three are public so far.

Nissan's filing shows most concretely what an organization loses when its HR platform falls. In breach notifications filed with the California Attorney General's Office, Nissan Americas states it uses PeopleSoft to manage employee information including payroll and tax administration, and that accessed personal information may include employee contact information, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary information. Affected people are current and former employees in the United States, Canada, Mexico, and Brazil. Nissan has also restricted access to pay slips and direct deposit changes to company network computers or secured VPN connections, and is adding identity verification before processing payroll requests. Run that list against what your own PeopleSoft instance holds.

NAIC identified unauthorized access to its PeopleSoft system on June 11, acknowledged the intrusion, and pushed back on the attackers' claims: what was taken, it says, was already-public statutory financial reports, credit rating agency data, outdated logs, and configuration information, with no evidence of PII or financial data exposure. It also directly disputed claims that core regulatory platforms — SERFF, OPTins, SBS — were compromised. ShinyHunters, in a June 25 update, claims 3.1 TB across 105,000 files. The two accounts are far apart, yet the operational damage was real: credit rating agencies temporarily suspended data feeds and NAIC paused investment designation work. Even an organization that can credibly say "nothing sensitive left" still stops working.

The University of Nottingham saw roughly 455,000 student and alumni records, over 40 GB, published — names, addresses, and phone numbers alongside passport numbers and ethnicity and disability information. That is data no one can rotate. Set against Mandiant's figure that 68% of notified organizations were higher education, more disclosures of this kind should be expected.

The link to the concurrent ShinyHunters attacks: separating confirmed from unconfirmed

Around the emergency alert, a large-scale data-theft campaign against PeopleSoft was reported, and the connection was initially unclear. Subsequent third-party analysis has settled most of it. Here is what is now established, and what still is not.

With attribution and root cause both settled, there is nothing left to weigh. A 9.8 flaw that allows takeover without authentication was used as a zero-day two weeks before the patch existed, and real companies have had payroll data taken. The choice for affected organizations is patch now, or block the paths until you can. We could not confirm any verifiable X (formerly Twitter) posts from those involved or from researchers about this specific issue, so this article includes no embeds.

Impact and response at a glance

We also track Oracle's monthly and quarterly patches in this article. The July 21, 2026 Critical Patch Update carried 84 fixes for PeopleSoft, 45 of them remotely exploitable without authentication. No additional patch specific to this CVE has appeared since the June 10 emergency alert, so apply the June alert fix first and roll the July CPU through your normal process.

What administrators should do now

This applies to every organization running PeopleSoft (PeopleTools 8.61 / 8.62). In priority order:

1. Apply Oracle's emergency patch immediately. This is the core action. From the Oracle Security Alert, go to the fix for your version (the Patch Availability Document), obtain the patch via My Oracle Support, and apply it. This is a case to pull forward even into an unplanned maintenance window, rather than wait for the next quarterly update.

2. Block the exploited paths from outside. The attack works over the network. At the perimeter or firewall, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector. Per Mandiant, restricting these endpoints does not break standard PIA (PeopleSoft Internet Architecture) browser sessions. Alongside that, disable the EMHub service in multi-server configurations, or remove the PSEMHUB application outright in single-server configurations. This is the fastest way to buy time before patching.

3. Monitor outbound SMB (TCP 445). During exploitation the PeopleSoft server may open SMB connections to external destinations, handing attackers the Windows machine-account NetNTLM hash. A PeopleSoft server has no business reason to reach port 445 on the internet, so adding this to your detection set catches exploitation early at almost no cost.

4. Check for signs of compromise. Exploitation goes back to May 27, 2026 — before the patch existed. Operate on the assumption that you may already have been breached. In web server logs, hunt for external POSTs to /PSEMHUB/hub and /PSIGW/HttpListeningConnector. On disk, look for unexpected .jsp files under PSEMHUB.war, unauthorized files under envmetadata/transactions, and directories named logs, persistantstorage, or scratchpad. The attacker IPs published by Horizon3.ai (142.11.200[.]186-190, 108.174.202[.]99, 176.120.22[.]24) are useful for log correlation.

5. Map the blast radius and prepare for notification. PeopleSoft concentrates employees' and students' personal data. Take the categories from Nissan's filing — contact details, bank accounts, Social Security and national ID numbers, financial and tax information, dependent and beneficiary data — and match them against your own records, then confirm your inventory of affected data, your reporting path to data-protection authorities, and your notification policy. Nissan's move of restricting pay slip access and direct deposit changes to the corporate network or VPN is something any organization can copy today.

Bottom line: an HR vault that opens without a login, and a rare Oracle emergency patch

What CVE-2026-35273 lays bare is that PeopleSoft — the HR and payroll foundation where an organization's most sensitive data is concentrated — can be taken over remotely with no ID and no password. The hole was being used as a zero-day two weeks before Oracle's emergency patch. Mandiant confirmed ShinyHunters (UNC6240) as the operator, CISA put it in KEV, and Nissan and NAIC have disclosed breaches — the speculative phase is long over.

What to do is clear. Organizations on PeopleTools 8.61 / 8.62 should apply Oracle's emergency patch now; until they can, block /PSEMHUB/* and /PSIGW/HttpListeningConnector externally and monitor outbound SMB; and hunt logs and files back to May 27. The data categories listed in Nissan's filing sit in every company's HR system. With the key to the HR vault turning without authentication, "wait and see" is not on the table.

References

• ▸Oracle - Security Alert CVE-2026-35273
• ▸Oracle Blog - Security Alert CVE-2026-35273 Released
• ▸NVD - CVE-2026-35273
• ▸TechCrunch - Cybercriminals claim breach of Oracle PeopleSoft servers at 100+ organizations
• ▸BleepingComputer - Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks
• ▸SecurityWeek - Many Organizations Using Oracle PeopleSoft Vulnerable to Attacks
• ▸SecurityWeek - Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters
• ▸Rapid7 - Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
• ▸The Hacker News - ShinyHunters Exploits Oracle PeopleSoft Zero-Day
• ▸BleepingComputer - Nissan discloses employee data breach linked to Oracle zero-day attacks
• ▸BleepingComputer - NAIC says public data stolen in ShinyHunters' PeopleSoft breach
• ▸Oracle Docs - Environment Management Framework
• ▸CISA KEV Catalog