Oracle PeopleSoft CVE-2026-35273 RCE Actively Exploited

On June 10th, 2026, Oracle disclosed a critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2026-35273, impacting its PeopleSoft PeopleTools application. This flaw carries a CVSS score of 9.8, designating it as critical, and allows for complete compromise of affected systems without requiring authentication.

Reports from Mandiant and Google Threat Intelligence Group (GTIG) on June 11th, 2026, confirmed that CVE-2026-35273 was exploited as a zero-day vulnerability. Exploitation has been observed in the wild since at least May 27th, 2026, preceding Oracle's public disclosure and patch availability by approximately two weeks.

The financially motivated threat actor known as ShinyHunters has been identified using CVE-2026-35273 as an initial access vector. Their campaigns have predominantly targeted organizations in the higher education sector, aiming to conduct data extortion operations. Active exploitation continues, requiring immediate attention and remediation by affected organizations.

What is CVE-2026-35273 and why is it critical?

CVE-2026-35273 is an unauthenticated Remote Code Execution (RCE) vulnerability affecting Oracle PeopleSoft PeopleTools. With a CVSS score of 9.8, it represents a critical security flaw. Its criticality stems from the ability of an attacker to execute arbitrary code on the affected server without needing any prior authentication. This level of access grants full control over the compromised PeopleSoft Enterprise PeopleTools system.

The primary risk associated with CVE-2026-35273 is the potential for complete system takeover. Attackers can use this to establish a foothold within a target network, leading to other malicious activities like data exfiltration, lateral movement, and malware deployment. Organizations utilizing Oracle PeopleSoft are at significant risk due to the widespread use of these platforms for managing sensitive enterprise data, including student, financial, and human resources information. Real-world exploitation by a financially motivated threat actor demonstrates the immediate and severe danger this vulnerability presents.

What can an attacker achieve with CVE-2026-35273?

An attacker successfully exploiting CVE-2026-35273 can achieve unauthenticated Remote Code Execution (RCE) on the vulnerable Oracle PeopleSoft PeopleTools server. This allows for full takeover of the PeopleSoft Enterprise PeopleTools application, providing the attacker with system-level control. Such control enables a range of malicious activities, including direct data access and manipulation.

The ShinyHunters threat group has specifically used this vulnerability as an initial access method to facilitate data extortion. Upon gaining access, they deploy customized MeshCentral agents, which are then used to perform reconnaissance, execute arbitrary commands, facilitate lateral movement within the network, and exfiltrate sensitive data. Data exfiltrated from victims has been subsequently posted on ShinyHunters' Data Leak Sites. This shows the severe consequences for organizations, particularly those in sectors like higher education, which rely heavily on PeopleSoft for critical data management.

How is CVE-2026-35273 being exploited in the wild?

CVE-2026-35273 is being actively exploited by the financially motivated threat actor ShinyHunters. Exploitation was observed as early as May 27th, 2026, making it a zero-day vulnerability at the time of initial attacks, roughly two weeks before Oracle's public disclosure on June 10th, 2026. This created a significant window of opportunity for attackers before patches were made available.

The attack vector involves targeting specific endpoints within the Oracle PeopleSoft PeopleTools application, namely /PSEMHUB/hub/ and /PSIGW/HttpListeningConnector, to achieve unauthenticated RCE. After gaining initial access through CVE-2026-35273, ShinyHunters deploys customized MeshCentral agents. These agents are disguised as legitimate cloud endpoints and serve as a persistent backdoor, enabling the threat actors to run queries, move laterally across the compromised network, and execute custom scripts. Data exfiltration, a key objective for ShinyHunters, was confirmed, with victim data appearing on their Data Leak Sites as early as June 9th, 2026. For a deeper dive into the specific tactics used by this group, refer to our prior analysis of ShinyHunters exploiting the Oracle PeopleSoft zero-day vulnerability. Our team has also conducted additional research on how ShinyHunters uses CVE-2026-35273 for RCE in Oracle PeopleSoft.

Which products are affected by CVE-2026-35273?

The CVE-2026-35273 vulnerability specifically impacts the Oracle PeopleSoft PeopleTools application. Organizations running certain versions of this product are vulnerable to unauthenticated Remote Code Execution.

The affected product lines and their corresponding vulnerable versions are:

  • PeopleSoft Enterprise PeopleTools
  • Version 8.61
  • Version 8.62

Organizations should review their deployments of PeopleSoft PeopleTools to identify if any of these versions are in use and are internet-exposed.

Detection

Detecting exploitation attempts and successful compromises related to CVE-2026-35273 requires several approaches, focusing on network, host, and log information. Organizations should implement rigorous monitoring to identify anomalous activity originating from or targeting Oracle PeopleSoft deployments.

Key detection strategies include:

  • Log Analysis:
  • PIA WebLogic access logs: Audit for HTTP POST requests directed specifically at /PSEMHUB/hub and /PSIGW/HttpListeningConnector. Pay close attention to requests originating from external or untrusted source IP addresses. Malicious requests may exhibit unusual parameters or payload sizes indicative of RCE attempts.
  • System logs: Monitor for unexpected process creation, especially shell processes or unusual binaries being executed under the context of the PeopleSoft application. Look for processes initiating outbound connections.
  • Network Monitoring:
  • Outbound firewall logs and NetFlow data: Monitor for outbound Server Message Block (SMB) traffic on port 445 originating from PeopleSoft hosts to untrusted or unexpected external destinations. This can indicate lateral movement or data exfiltration attempts.
  • Command and Control (C2) indicators: Monitor network traffic for connections to known ShinyHunters staging and C2 infrastructure.
  • Endpoint Detection and Response (EDR):
  • Malicious MeshAgent activity: EDR solutions should be configured to detect the presence and activity of customized MeshCentral agents. These agents may operate under suspicious process names or attempt to communicate with known C2 infrastructure. Look for agents disguised as legitimate cloud endpoints.
  • File integrity monitoring: Implement monitoring for unexpected file creation, modification, or execution on the web-tier filesystem of PeopleSoft hosts. This includes new scripts, executables, or modifications to existing configuration files.
  • Identified Indicators of Compromise (IOCs):
  • IP Addresses (Staging & C2):
  • 142.11.200.186
  • 142.11.200.187
  • 142.11.200.188
  • 142.11.200.189
  • 142.11.200.190
  • Domain (Staging & C2):
  • azurenetfiles.net
  • SHA256 Hashes:
  • 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35 (Attacker Command History)
  • f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc (Pre-configured Windows Agent)
  • d83fdb9e53c5ff03c4cb041b4dea97188a97e78589deee2a7bacff905564f3a35 (Pre-configured Windows Agent)
  • c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f (Pre-configured Windows Agent)
  • 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309 (Unconfigured Linux agent)
  • Forensic Auditing:
  • Web-tier filesystem: Conduct a forensic audit of the web-tier filesystem on PeopleSoft hosts to identify any unauthorized files, scripts, or changes. This includes checking for the presence of web shells, unexpected binaries, or altered configuration files, which could indicate compromise.

Remediation

Prompt and effective remediation is critical given the active exploitation of CVE-2026-35273. Organizations must prioritize patching and, where immediate patching is not feasible, implement strong mitigation strategies.

The following remediation steps are recommended:

  • Patching:
  • Apply the relevant security patches released by Oracle for PeopleSoft Enterprise PeopleTools. Oracle's disclosure on June 10th, 2026, implies the availability of these patches. Prioritize patching of all internet-facing PeopleSoft instances.
  • Workarounds and Mitigations (if immediate patching is not possible):
  • Disable the Environment Management Hub (EMHub) Service: Disabling this service can reduce the attack surface by eliminating a potential vector for exploitation. Ensure this action does not negatively impact critical business operations before implementation.
  • Restrict external network access: Block external network access to PeopleSoft PeopleTools and specifically to the sensitive endpoints /PSEMHUB/hub/ and /PSIGW/HttpListeningConnector at the network perimeter or firewall level. This prevents unauthenticated attackers from reaching the vulnerable components.
  • Post-Compromise Actions:
  • Conduct a thorough forensic investigation: If compromise is suspected or confirmed, initiate a full forensic audit of all affected PeopleSoft systems. This should include analysis of web-tier filesystems, system memory, and persistent storage to identify the full scope of the breach.
  • Rotate credentials: Assume compromise of any credentials stored on or accessible from the compromised PeopleSoft instance and initiate a forced rotation of all relevant administrative and service account credentials.
  • Isolate affected systems: Immediately isolate any systems confirmed to be compromised from the rest of the network to prevent further lateral movement and data exfiltration.

Technical Takeaways

  • CVE-2026-35273 is a critical, unauthenticated RCE vulnerability in Oracle PeopleSoft PeopleTools (CVSS 9.8).
  • The ShinyHunters threat actor group has actively exploited this flaw as a zero-day since May 27th, 2026, for data extortion, targeting endpoints /PSEMHUB/hub/ and /PSIGW/HttpListeningConnector.
  • Affected versions include PeopleSoft Enterprise PeopleTools 8.61 and 8.62.
  • Post-exploitation, ShinyHunters deploys customized MeshCentral agents for persistence, lateral movement, and data exfiltration activities.
  • Detection involves auditing PIA WebLogic access logs, monitoring outbound SMB traffic (port 445), and employing EDR for MeshAgent activity.
  • Remediation requires applying Oracle-provided patches and, as an interim measure, disabling the EMHub Service or blocking external access to sensitive PeopleSoft endpoints.