Oracle PeopleSoft CVE-2026-35273 Added to KEV After ShinyHunters Exploitation

On June 12, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-35273, a critical Oracle PeopleSoft zero-day vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability is a Remote Code Execution (RCE) flaw in Oracle PeopleSoft Enterprise PeopleTools Environment Management component (PSEMHUB), which carries a CVSS v3.1 score of 9.8 (Critical). The addition to the KEV catalog followed active exploitation by the ShinyHunters extortion group, who claimed the breach affected over 100 organizations.

What Happened

Between May 27 and June 9, 2026, the notorious ShinyHunters extortion group actively exploited CVE-2026-35273, a zero-day RCE in Oracle PeopleSoft Enterprise PeopleTools. This campaign, tracked by Mandiant and Google Threat Intelligence Group (GTIG), specifically targeted the Updates Environment Management component (PSEMHUB), as detailed by NVD. ShinyHunters achieved initial access by chaining this new vulnerability with older, unspecified flaws. Oracle released an out-of-band security alert and urged immediate patching for CVE-2026-35273 on June 10, 2026, barely a day after the active exploitation window closed.

Upon successful exploitation, attackers deployed custom MeshCentral remote-management agents, masquerading as Microsoft Azure binaries, and a lateral-movement script. Mandiant reports that post-compromise activities included credential spraying and reuse of common administrative accounts to broaden access within compromised environments, as noted by Trend Micro. The attackers left staging files, including a shared .bash_history and a victim-specific _fanout.sh script designed for internal SSH spraying. A marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT was also dropped into affected PeopleSoft directories. Data exfiltration involved compressing sensitive information with zstd and transmitting it via an outbound SSH connection to a server hosting a public mirror of the ShinyHunters leak site, as reported by The Hacker News.

Victims reportedly started receiving extortion messages from ShinyHunters on June 9, 2026, indicating data exfiltration occurred before the public disclosure and patching efforts. On June 12, 2026, CISA added CVE-2026-35273 to its KEV Catalog, confirming in-the-wild exploitation.

Why It Matters

This is a zero-day RCE actively exploited by a prolific extortion group against high-value targets. The CVSS v3.1 score of 9.8 means unauthenticated attackers with simple network access could fully compromise systems without any user interaction. The primary target sector, education, represents a goldmine of personally identifiable information (PII), academic records, and financial data for threat actors, and many of these institutions are strapped for resources.

ShinyHunters claims to have compromised over 100 organizations and approximately 300 PeopleSoft instances through this campaign, with universities accounting for 68% of the identified vulnerable endpoints. These claims have not been independently verified by Oracle or affected organizations, though the University of Nottingham has confirmed a breach. Cloud-hosted and on-premises deployments were equally vulnerable. A confirmed victim is the University of Nottingham, which publicly acknowledged a cybersecurity incident. ShinyHunters claims to have leaked over 40 GB of data from the university, impacting around 454,600 current and former students across its UK, Malaysia, and China campuses, according to BleepingComputer. The University of Nottingham has confirmed a breach but has not publicly detailed the exact size or scope of the exfiltrated data.

Exposed University of Nottingham data, as claimed by ShinyHunters, included names, email and postal addresses, phone numbers, dates of birth, student ID numbers, course information, National Insurance numbers, passport numbers, financial aid data, billing and payment records, and credit card details. This level of data exposure often leads to widespread identity theft, financial fraud, and further targeted phishing attacks. The addition of CVE-2026-35273 to the CISA KEV Catalog mandates U.S. federal agencies to patch PeopleSoft installations quickly, but all organizations running PeopleSoft should consider this a top-tier threat.

Affected Scope & Remediation

The CVE-2026-35273 vulnerability impacts Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Earlier, unsupported versions are also highly likely to be vulnerable, though Oracle’s advisory focuses on currently supported releases. Organizations running any PeopleSoft instance need to immediately assess their exposure.

Patch it now. Oracle released an out-of-band security alert for CVE-2026-35273 on June 10, 2026, urging immediate patching. This is not a "wait for Patch Tuesday" situation.

Here are the crucial links:

• NVD Entry: CVE-2026-35273
• CISA KEV Catalog Entry: CVE-2026-35273
• Oracle Security Alert: Oracle PeopleSoft Critical Vulnerability CVE-2026-35273 (check Oracle's official security advisories page for the specific bulletin for June 2026 or an emergency release).

If immediate patching isn't feasible, critical mitigation steps include:

• Disable the Environment Management Hub service on multi-server setups.
• Remove the PSEMHUB application on single-server setups.
• Block external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at your perimeter firewall. This directly addresses the network-accessible nature of the exploit. These actions align with the NIST SP 800-53 control SC-7 Boundary Protection, limiting direct exposure.

The timeline shows a clear zero-day scenario: exploitation was observed from May 27 to June 9, 2026. Oracle released its patch on June 10, 2026, just one day after the known exploitation window concluded. CISA added it to the KEV on June 12, 2026. For U.S. federal civilian executive branch agencies, CISA KEV entries typically have a 6-month remediation deadline from the listing date, but given active exploitation, this should be treated with far greater urgency by all organizations. Implementing endpoint detection and response (EDR) solutions like CrowdStrike Falcon can help identify post-exploitation activity even if an initial exploit bypasses perimeter defenses.

Technical Breakdown

CVE-2026-35273 is an unauthenticated Remote Code Execution flaw, meaning an attacker doesn't need valid credentials or prior access to execute arbitrary code. The vulnerability lies within the Updates Environment Management component of PeopleSoft Enterprise PeopleTools (PSEMHUB), specifically exploitable via HTTP. This allows an attacker to interact directly with the vulnerable service over the network. It's like finding a small, unlocked side door in a seemingly secure building. While the main entrance might have strong security, this side door, PSEMHUB, leads directly into the critical infrastructure, allowing full control without needing to go through any other checkpoints.

ShinyHunters didn't just use this zero-day in isolation. They employed a "gadget chain," combining CVE-2026-35273 with older, unspecified vulnerabilities. This approach maximizes impact; the zero-day provides the initial unauthenticated RCE, then the older flaws facilitate deeper compromise or privilege escalation. This is a common tactic, where a newly discovered high-impact bug is used to kick off a more complex attack sequence.

Once initial access was gained through this RCE (which falls under MITRE ATT&CK T1190 Exploit Public-Facing Application), the attackers moved quickly. They deployed custom MeshCentral agents, an open-source remote management tool, to maintain persistent access (T1219 Remote Access Software). These agents were disguised as Microsoft Azure binaries, an attempt at T1036 Masquerading to blend in with legitimate system processes.

Lateral movement was achieved via a custom script that performed T1110.003 Password Spraying against internal hosts over SSH, using hardcoded usernames and passwords. This highlights a critical need for strong password policies and the NIST SP 800-53 control IA-2 Identification and Authentication (Organizational Users), complemented by AC-3 Access Enforcement. MFA enforcement and password rotation can help mitigate credential reuse across systems. Data exfiltration was conducted by compressing files with zstd and sending them over an outbound SSH connection to an external server hosting their leak site mirror, aligning with T1048 Exfiltration Over Alternative Protocol. This entire chain shows a well-resourced and methodical threat actor.

Historical Context

ShinyHunters is a persistent and highly active extortion group, known for its high-volume data theft campaigns. Their operational pattern of targeting widely used enterprise platforms and the education/SaaS sectors is consistent across their activities. For instance, in April 2026, ShinyHunters was linked to a significant data breach affecting the Canvas LMS, which reportedly exposed data for 275 million users. Instructure, the company behind Canvas LMS, has not confirmed the scope of this breach.

Similar to the PeopleSoft campaign, the Canvas LMS breach involved exploiting a platform widely used by educational institutions to exfiltrate large quantities of sensitive user data. Both incidents demonstrate the group's focus on industries rich in PII and their capability to exploit critical vulnerabilities in popular software. While the Canvas LMS attack details might have differed in the initial access vector (the specifics of which were less clear in public reporting), the outcome – mass data exfiltration followed by extortion – remains ShinyHunters' signature. They also hit ADT (April 2026, 5.5 million individuals), Panera Bread (January 2026, 5 million people), and the European Commission (March 2026, 350GB of data), showcasing their diverse targeting and consistent operational tempo throughout 2026 alone. The consistent element is the focus on large datasets from high-profile, widely used services. These numbers represent claims by ShinyHunters and have not all been independently verified by the affected organizations.

Data at a Glance

The CVEDaily Take

This PeopleSoft RCE highlights the critical need for proactive vulnerability scanning and network segmentation, especially for systems like PSEMHUB that shouldn't be exposed externally. The CISA KEV listing underscores the immediate risk. ShinyHunters' claim of 100+ compromised organizations and 300 PeopleSoft instances, if accurate, suggests a widespread failure in basic perimeter defense for a widely used enterprise application. We believe Oracle's swift out-of-band patch release indicates the severity of the threat but also raises questions about why this component was Internet-facing to begin with for so many organizations. This incident shows that even critical enterprise software is often deployed without sufficient hardening.

Are you actively auditing your externally exposed PeopleSoft components, even those you think are protected by a WAF or VPN?

FAQ

Q: What specific versions of Oracle PeopleSoft are vulnerable to CVE-2026-35273?
A: Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are specifically confirmed vulnerable, and earlier, unsupported versions are also highly likely to be affected.

Q: What are the immediate mitigation steps if we cannot patch CVE-2026-35273 right away?
A: Immediately disable the Environment Management Hub service on multi-server setups, remove the PSEMHUB application on single-server setups, and block external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at your network perimeter.

Q: How did ShinyHunters use CVE-2026-35273 in their campaign?
A: ShinyHunters used the zero-day RCE to gain initial access via an unauthenticated HTTP request, then chained it with older vulnerabilities to escalate privileges and establish persistence. They deployed custom MeshCentral agents, performed internal password spraying via SSH, and exfiltrated data compressed with zstd over SSH to their C2 servers.