The exploitation of an unpatched flaw in the Oracle PeopleSoft system by ShinyHunters resulted in the theft of sensitive enterprise information. The target of ShinyHunters' attack campaign was primarily institutions of higher learning.
According to Google's Mandiant, the exploitation of the flaw, tracked as UNC6240, occurred between May 27th and June 9th. On June 10th, Oracle published its advisory regarding CVE-2026-35273. Therefore, during the entire period the flaw remained unpatched it represented a zero-day vulnerability.
CVE-2026-35273 represents a remote code execution vulnerability within PeopleSoft Enterprise PeopleTools. The vulnerability is assigned a severity rating of 9.8 out of 10. Additionally, it does not require a valid login to exploit or user interaction other than providing network access through HTTP. Therefore, if users have implemented PeopleSoft such that the Environment Management Hub (the hub portion of the Updates Environment Management component) is accessible from outside their organisation, they will need to implement additional security measures to mitigate risk. As a temporary measure, the recommended action is to restrict external access to the Environment Management Hub endpoints (PSEMHUB) and/or PSIGW/HttpListeningConnector. This action should also include disabling user session functionality while remediation efforts are undertaken.
The vulnerability exists within the Updates Environment Management component of PeopleTools. Oracle states that PeopleTools 8.61 and 8.62 are impacted and implies that previous (unsupported) versions of PeopleTools could potentially also contain the vulnerability. The researchers who identified the vulnerability were credited by Oracle as Trend AI Zero Day Initiative and Trend AI Research.
Charles Carmakal, Mandiant's Chief Technology Officer, confirmed that the reported vulnerability is currently being exploited by threat actors. However, at present there is no confirmation from Oracle whether they have observed exploitation of the vulnerability. The advisory issued by Oracle provides references to documents detailing patches available via their support portal and indicates that a complete fix for all environments may not yet be available. Based on this information, mitigation strategies have been emphasised.
Publicly available information pertaining to the operation of the threat actors became available due to the threat actors themselves leaving their equipment accessible to researchers. Researchers used publicly disclosed open directories to identify an IP address range associated with the attackers. Mandiant identified five consecutive IP addresses using Python's SimpleHTTP Server (on port 8888), exposing files associated with staging activities, including a shared .bash_history file, MeshCentral remote management agents (customised to appear as Microsoft Azure binaries) and a lateral movement script.
Agents contacted a command-and-control (C2) server located at azurenetfiles.net, a domain chosen to resemble Azure NetApp Files. The spread agent (named [victim]_fanout.sh) conducts a brute-force style SSH scan across internal hosts obtained via /etc/hosts, dropping a marker file entitled "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT" in PeopleSoft directories. The attacker's command history showed they conducted a compression operation using zstd, followed by establishing an outbound SSH connection to a host containing the public-facing copy of ShinyHunters' leak site.
Over 100 organisations were notified by Mandiant based on identifying their IP addresses matching known vulnerable endpoints. Sixty-eight percent of these organisations were educational entities, most of whom were based in the United States. Approximately sixty-eight percent of the organisations notified took steps to block future attempts, while approximately thirty-two percent had previously been successfully compromised, resulting in some form of their data having been added to the leak site.
The University of Nottingham is reportedly one of the earliest confirmed victims. According to Have I Been Pwned, approximately 455,000 unique email addresses contained in the leaked dataset included both active students and alumni, along with student identification information, telephone numbers, passport numbers and demographic information related to ethnicity and disabilities. The university has also acknowledged the incident.
Oracle's guidance for mitigating risks posed by CVE-2026-35273 includes disabling the Environment Management Hub services on multi-server configurations or removing the PSEMHUB application altogether on single-server configurations. If neither option is viable, restricting access to /PSEMHUB/* (with particular emphasis on /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the organisational perimeter is highly recommended.
Furthermore, according to Mandiant, relying solely on Web Application Firewall (WAF) body inspection-based rules for protection may not be sufficient, because these types of rules can often be circumvented. Restricting access to these endpoints should not cause disruption to normal user sessions.
In order to detect potential compromises of PeopleSoft:
- Look for entries in WebLogic access logs indicating external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector.
- Search for unusual .jsp files under the PSEMHUB.war web application directory or unexpected folders (logs, persistent storage or scratch pad) under the PSEMHUB paths.
- Identify changes made to .xml files recently created in the web doc roots environment/envmetadata/data/environment folder that can be utilised for XMLDecoder persistence, which will execute when restarted.
- Determine if outbound SMB communications on port 445 are occurring from PeopleSoft hosts communicating with external destinations.
- Once you have validated that you are able to obtain patches for your PeopleTools version from My Oracle Support, apply them immediately.
Additionally, ShinyHunters indicated that victim outreach has only begun and that many more organisations are likely to have data stolen and posted online, as ShinyHunters has stated that it has not yet published data for most of the organisations listed as victims.
The real indicator of what type of threat actors ShinyHunters represent is how they conduct operations. Historically, ShinyHunters have leveraged techniques such as phishing, token theft and poor access controls to exfiltrate data from SaaS and education platforms, including Salesforce customers and Canvas. Exploiting a server-side zero-day in on-premises ERP software indicates that they intend to continue targeting similar high-value targets.
It remains to be seen whether this is merely a one-time borrowed zero-day or whether ShinyHunters are beginning to utilise ERP exploits in their campaigns.
