ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

What happened

The critical Oracle PeopleSoft bug that ShinyHunters (criminal internet hacker group) has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Oracle is an information technology consulting and software development company based in Redwood Shores, and its products and services include API management, relational database management systems and database management systems.

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws  Swati Khandelwal  Oct 28, 2026 Vulnerability / Enterprise Security The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

In its analysis , ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each. Oracle released its fix in an out-of-band security alert on June 10.

The flaw is on CISA's Known Exploited Vulnerabilities catalog. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution (running programs on a machine from somewhere else) without a login.

The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle. As of this week, the one June identifier is still the only one on the record.

CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over the server over the network. Attackers were already using it before that fix was in place.