ShinyHunters' Oracle PeopleSoft Zero-Day Was Actually Three Flaws Chained Together

The critical Oracle PeopleSoft flaw that the ShinyHunters group has exploited since May is not a single bug, according to the researchers who reported it. Bobby Gould of the Zero Day Initiative (ZDI) said the team reported three distinct vulnerabilities across two PeopleSoft components. Oracle patched all of them in an out-of-band alert on June 10 under one identifier, CVE-2026-35273, and ZDI is working with Oracle to assign a separate CVE to each. The flaw affects PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over a server over the network. It is listed on CISA's Known Exploited Vulnerabilities catalog.

The chain starts with a server-side request forgery (SSRF) in the Integration Gateway component. An attacker can control where the request goes and what it contains, because the system does not check the destination. That reaches an internal management interface, which PeopleSoft trusts by default when requests appear to come from its own loopback address. This opens the door to remote code execution without a login.

Mandiant and Google Threat Intelligence Group attribute exploitation between May 27 and June 9 to UNC6240, better known as ShinyHunters, mostly against universities. That made it a zero-day before the patch existed. A September follow-up described a larger wave reaching technology, IT services, healthcare, agriculture, transport and government, affecting dozens of systems worldwide.