Oracle PeopleSoft zero-day exploited by ShinyHunters was three chained flaws, researchers say

The critical Oracle PeopleSoft vulnerability that the ShinyHunters group has exploited since May is not a single bug but three flaws chained together, the researchers who reported it said this week, according to The Hacker News.

Oracle patched all three under one identifier, CVE-2026-35273, in June. The root of the chain is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address, the report says.

The underlying flaw is a missing authentication issue in PeopleSoft Enterprise PeopleTools, in the Updates Environment Management component. Oracle's advisory lists versions 8.61 and 8.62 as affected and describes an unauthenticated attacker with network access over HTTP who could take over the product. The CNA scored it 9.8 under CVSS 3.1. CISA added it to its Known Exploited Vulnerabilities catalog with a due date of 2026-06-15 and notes known ransomware use.

Why it matters

The disclosure is not a new incident. It's a correction to how the bug was understood: what defenders treated as one flaw is a chain, which changes how exposure should be assessed.

What defenders should do

• Confirm which PeopleSoft versions you run and whether the June fix is applied.
• Treat internet-facing PeopleSoft as high risk and review what internal interfaces it can reach.
• Check logs for requests that appear to originate from the server's own loopback address.
• Follow the vendor advisory and CISA's KEV guidance for your environment.

The report doesn't detail the other two flaws in the chain or say whether exploitation continued after patching.

CVE references

CVE-2026-35273