erroneo.us
Search all guides⌘K

Security Digest · Jun 10, 2026 · Vulnerability · Other

Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day

Unauthenticated RCE in PeopleTools 8.61/8.62 used by ShinyHunters against 100+ orgs, mostly universities. Apply Oracle's fix, disable EMHub, hunt. Act now.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Act now

If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.

Who must act: PeopleSoft customers on PeopleTools 8.61 or 8.62, above all universities running Campus Solutions and any organization with PeopleSoft exposed to the internet.

Who can relax: Organizations that do not run PeopleSoft, or whose PeopleSoft web tier is reachable only from internal networks and has been patched, are at much lower risk.

Affected
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Updates Environment Management component); PeopleSoft Enterprise Applications built on them
Fixed in
Oracle Security Alert for CVE-2026-35273 (June 10, 2026); follow the PeopleSoft Patch Availability Document for the mitigation or patch for your release
CVSS
9.8 (v3.1, vendor)
EPSS
96.7% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Apply the remediation in Oracle's CVE-2026-35273 Security Alert for PeopleTools 8.61/8.62
  2. Disable the Environment Management Hub (EMHub) in multi-server setups, or remove the PSEMHUB application in single-server setups
  3. Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter (non-breaking for normal PIA sessions, per Mandiant)
  4. Block outbound SMB (TCP 445) and unneeded outbound HTTPS from PeopleSoft servers
  5. If compromised, rotate database connection strings, service account passwords and SSH keys found on PeopleSoft hosts

How to check if you are affected or compromised

  • Review WebLogic access logs for external POSTs to /PSEMHUB/hub and /PSIGW/HttpListeningConnector, especially requests carrying 127.0.0.1/localhost
  • Look for unexpected .jsp files under PSEMHUB.war and new .xml files in envmetadata/data/environment/
  • Search for README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT and *_fanout.sh scripts
  • Hunt for MeshCentral agents (meshagent64-azure-ops.exe etc.) and traffic to azurenetfiles.net or 142.11.200.186-190

What happened#

On June 10, 2026, Oracle published an out-of-band Security Alert for CVE-2026-35273, a flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. Oracle says it is "remotely exploitable without authentication" and "may result in remote code execution." The CVE record scores it CVSS 3.1 9.8. Oracle credits researchers from TrendAI and its Zero Day Initiative with reporting it.

By then the bug had been exploited for two weeks. Mandiant and Google Threat Intelligence attribute exploitation between May 27 and June 9, 2026 to UNC6240, better known as ShinyHunters. They notified more than 100 organizations, mostly in the US, and 68% of them were universities and colleges. Stolen data was posted to the ShinyHunters leak site on June 9. The attackers themselves claimed about 300 PeopleSoft instances at more than 100 organizations, a figure SecurityWeek notes is unverified. CISA added the CVE to the KEV catalog on June 12 with a three-day federal deadline, and flagged it as known to be used in ransomware campaigns.

Mandiant says the intrusions targeted the EMHub (/PSEMHUB) endpoints and used an SSRF-style technique through /PSIGW/HttpListeningConnector. Attackers then planted XMLDecoder-based persistence, installed MeshCentral agents disguised as Azure services, sprayed SSH credentials with a per-victim _fanout.sh script, and compressed the stolen data with zstd.

Who is affected#

Oracle lists PeopleTools 8.61 and 8.62 and warns that PeopleSoft Enterprise Applications customers "may also be affected." Higher education took the brunt through Campus Solutions deployments that hold student records, government IDs and financial aid data. The Cloud Security Alliance cites the University of Nottingham breach of about 454,600 student records as one public example.

Do you really need to act?#

Yes, if you are on 8.61 or 8.62 and the PeopleSoft Internet Architecture (PIA) is reachable from the internet, which is normal for student and employee self-service portals. The bug requires no credentials and no user interaction, a capable extortion group has already used it at scale, and the payoff is the kind of data that triggers breach notification laws.

One point of confusion: Oracle's alert talks about "mitigations" and links to a Patch Availability Document. SecurityWeek reported on June 11 that only mitigations appeared to be available. Rapid7 and CSA describe an emergency patch (referenced as CPU187). Check the Patch Availability Document for your exact release rather than assuming. Disabling EMHub and blocking the two paths is effective either way, and Mandiant says it does not break normal PIA sessions. Patching does not remove an attacker who got in during the May 27 to June 9 window, or later on unpatched systems.

What to do now#

  1. Apply the fix from Oracle's CVE-2026-35273 Security Alert for your PeopleTools release.
  2. Disable the EMHub service (multi-server) or remove the PSEMHUB application (single-server), as Oracle and Mandiant advise.
  3. If you cannot disable it yet, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector. Mandiant warns that WAF body-inspection rules alone can be bypassed.
  4. Block outbound TCP 445 from PeopleSoft hosts. Mandiant says the chain may coerce SMB connections that leak machine-account NetNTLM hashes.
  5. If you find indicators, rotate every credential stored on the PeopleSoft hosts (database connection strings, service accounts, SSH keys) and engage counsel on notification obligations.

How to tell if you were hit#

  • WebLogic access logs showing external POSTs to /PSEMHUB/hub or /PSIGW/HttpListeningConnector, especially with loopback addresses in headers or parameters.
  • Unexpected *.jsp files under PSEMHUB.war/, new files under envmetadata/transactions/, or recently modified .xml files under envmetadata/data/environment/.
  • The marker file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, or *_fanout.sh scripts.
  • Mandiant IOCs: 142.11.200.186 through .190, azurenetfiles.net, 176.120.22.24, and MeshCentral agents named meshagent64-azure-ops.exe, meshagent64-v2.exe or meshagent32-azure-ops.exe.

Timeline#

  • — Attacker C2 configured; exploitation begins (Mandiant).
  • — Last observed exploitation in Mandiant's window; data posted to the leak site.
  • — Oracle Security Alert published.
  • — Mandiant/GTIG report published.
  • — Added to CISA KEV (due June 15).

Vulnerability records

  • CVE-2026-35273 · KEV 2026-06-12 · Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Oracle — Security Alert Advisory CVE-2026-35273 oracle.com
  2. CVE.org — CVE-2026-35273 cve.org
  3. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov
  4. Mandiant / Google Threat Intelligence — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit cloud.google.com
  5. Rapid7 — Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273 rapid7.com
  6. Cloud Security Alliance — Research Note: Oracle PeopleSoft Zero-Day labs.cloudsecurityalliance.org

Coverage and analysis

  1. SecurityWeek — Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks securityweek.com