In June, Oracle issued a security alert, with patches and mitigations, for a critical PeopleSoft flaw that attackers were already exploiting. Five months later the story has two new problems. Researchers at the Zero Day Initiative say the flaw was actually three separate vulnerabilities folded into a single CVE. And according to Mandiant, the extortion crew that exploited it has spread well beyond its first victims and deployed web shells on systems it reached.
The flaw is CVE-2026-35273. It affects Oracle PeopleSoft Enterprise PeopleTools, the technology layer under PeopleSoft applications. Oracle says PeopleSoft Enterprise Applications customers may also be affected. Organizations that patched in June and moved on should take another look.
The bug, briefly
Oracle's security alert says the vulnerability can be exploited remotely without authentication and "may result in remote code execution." Affected versions are PeopleTools 8.61 and 8.62. Oracle called implementation of its mitigations a "high-priority risk reduction measure" and strongly recommended immediate action. It also noted that patches and mitigations are provided only for versions still covered by Premier or Extended Support.
The National Vulnerability Database record lists a 9.8 (Critical) CVSS 3.1 base score, supplied by Oracle as the CVE's source. The vector is network-reachable, low complexity, and needs no privileges and no user interaction. NVD files it under the Updates Environment Management component and lists CWE-306, "Missing Authentication for Critical Function." Put simply, a part of PeopleTools that should have required a login did not. In NVD's words, an unauthenticated attacker with network access via HTTP could compromise PeopleSoft Enterprise PeopleTools, with successful attacks resulting in "takeover" of it. The record also carries CISA's exploitation data, which marks the bug as actively exploited and automatable, meaning attackers can script it and run it against many targets at once.
NVD published the record on June 11. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog the next day, June 12, with a remediation deadline of June 15. A three-day window is unusually short. CISA's catalog also lists the bug's known use in ransomware campaigns as "Known."
Who was exploiting it
ShinyHunters, the data-theft and extortion group, told The Register in early June that it had hacked more than 100 organizations through the PeopleSoft zero-day. That number is the group's own claim and has not been independently verified. According to The Register, Mandiant later confirmed that the group exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector.
The campaign did not stop there. The Register reports that by late September, Mandiant said ShinyHunters had massively expanded its targeting, "deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government."
A web shell is a small malicious script placed on a web server that gives an attacker a back door for running commands later. Patching does not touch it. Once a web shell is in place, closing the original hole does not remove the attacker's way back in, and The Register notes that patching alone may not remove attackers from already compromised systems.
One CVE, three bugs
The newest wrinkle concerns how the flaw was counted. The Register cites a blog post from the Zero Day Initiative (ZDI), whose researchers are identified in the coverage as TrendAI staff. ZDI says it found and reported three distinct vulnerabilities to Oracle in June, and The Register gives the date as June 10, one day before the CVE was published:
- a server-side request forgery (SSRF) flaw in the PeopleSoft Integration Gateway, a type of bug that tricks a server into making requests on the attacker's behalf;
- an external control of file path flaw in the PeopleSoft Environment Management Hub; and
- a deserialization of untrusted data flaw, also in the Environment Management Hub. Deserialization bugs happen when software trusts structured data it receives and rebuilds it into live objects, and they are a common route to code execution.
According to ZDI researcher Bobby Gould, each should receive its own CVE identifier rather than being grouped under CVE-2026-35273, and ZDI is coordinating with Oracle to assign separate CVEs. The Register says the three vulnerabilities, which span multiple PeopleSoft components, can be combined to achieve remote code execution.
This is not just paperwork. Security teams depend on CVE identifiers to track exposure, match scanner results, prioritize work and show auditors what was fixed. When three root causes share one ID, defenders lose detail. A scanner plugin, a WAF rule or a detection signature written for "CVE-2026-35273" may cover only one of the three attack paths. When the new CVEs are issued, vulnerability-management dashboards may show fresh entries for a problem that is already patched, or, more worryingly, treat a partial mitigation as complete. These are risks to plan for rather than documented failures, and we will not speculate beyond what the sources say.
A bad month for Oracle shops
The Register framed the PeopleSoft development as part of a run of Oracle problems at the end of October. Among them is probing activity against Oracle E-Business Suite (EBS) flaw CVE-2026-101767, a critical unauthenticated SQL injection bug that can lead to remote code execution. The Register reports that Defused Cyber's decoys recorded exploratory exploits against it on October 27, and that Oracle patched it in its October release. Organizations that run both PeopleSoft and EBS have two Oracle exposures to check.
What It Means for Defenders
Who is affected: any organization running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62, particularly if the PeopleSoft web tier can be reached from the internet. Mandiant, as relayed by The Register, reports victims in higher education, technology, IT services, healthcare, agriculture, transportation and government, with education the original focus.
Patch or mitigate, and confirm it worked. Apply the fixes and mitigations from Oracle's CVE-2026-35273 security alert. Oracle provides patches and mitigations through the alert only for PeopleTools versions under Premier or Extended Support, so an unsupported release needs an upgrade. CISA's KEV entry spells out the required action: apply vendor mitigations, or discontinue use of the product if mitigations are not available. Federal agencies and their contractors should note that the KEV due date (June 15, 2026) passed long ago. An unpatched instance now is a compliance finding as well as a security one.
Assume compromise if you were exposed before patching. The flaw was exploited as a zero-day, and patching does not remove web shells. Any PeopleTools 8.61 or 8.62 system that was reachable before you applied Oracle's fix should get a proper compromise assessment, not just a version check. Concretely:
- Review the PeopleSoft web and application server file systems for unexpected or recently modified scripts and files, comparing against a known-good baseline or a fresh vendor install where you can.
- Go through web server and application logs from the exposure window for unauthenticated requests to administrative, integration and environment-management functions, and for outbound connections from the PeopleSoft servers that you can't explain.
- If you find signs of intrusion, rebuild affected hosts rather than cleaning them in place, and bring in incident response.
Rotate what the server could reach. Remote code execution on PeopleSoft gives an attacker whatever that server holds: database credentials, integration and service-account passwords, API keys, and certificates used for connections to other systems. If a host may have been compromised, rotate those secrets after the host has been rebuilt or confirmed clean. Rotating before then lets the attacker capture the new ones.
Reduce exposure. PeopleSoft's integration and environment-management components rarely need to be open to the whole internet. ZDI's analysis notes that Oracle allows localhost by default and that a request from any trusted host can reach the Environment Management Hub, so review which hosts are trusted. Limit access to trusted networks or put it behind a VPN or an authenticating reverse proxy, so that the next unauthenticated bug in this code doesn't reach you directly.
Watch for the new CVEs. When ZDI's separate identifiers appear, check them against your scanner coverage and detection rules. Make sure your tools treat all three flaws as fixed only when Oracle's CVE-2026-35273 remediation is actually in place, and that detection content covers every path, not just the first one written.
Prepare for extortion. ShinyHunters' reported method is to steal data and then demand payment. If you find evidence of access, assume data may have been taken. Bring in legal and communications early, and check your breach-notification obligations under the regulations that apply to you, such as FERPA and HIPAA and, for defense contractors, the DFARS incident-reporting clauses tied to CMMC.
