---
title: "Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day"
url: https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/
description: "Unauthenticated RCE in PeopleTools 8.61/8.62 used by ShinyHunters against 100+ orgs, mostly universities. Apply Oracle's fix, disable EMHub, hunt. Act now."
type: security-brief
section: "Security Digest"
date_published: 2026-06-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-35273"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day

**Verdict: Act now.** If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.

- **Who must act:** PeopleSoft customers on PeopleTools 8.61 or 8.62, above all universities running Campus Solutions and any organization with PeopleSoft exposed to the internet.
- **Who can relax:** Organizations that do not run PeopleSoft, or whose PeopleSoft web tier is reachable only from internal networks and has been patched, are at much lower risk.
- **Affected:** Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Updates Environment Management component); PeopleSoft Enterprise Applications built on them
- **Fixed:** Oracle Security Alert for CVE-2026-35273 (June 10, 2026); follow the PeopleSoft Patch Availability Document for the mitigation or patch for your release
- **CVEs:** CVE-2026-35273
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Apply the remediation in Oracle's CVE-2026-35273 Security Alert for PeopleTools 8.61/8.62
2. Disable the Environment Management Hub (EMHub) in multi-server setups, or remove the PSEMHUB application in single-server setups
3. Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter (non-breaking for normal PIA sessions, per Mandiant)
4. Block outbound SMB (TCP 445) and unneeded outbound HTTPS from PeopleSoft servers
5. If compromised, rotate database connection strings, service account passwords and SSH keys found on PeopleSoft hosts

### How to check if you are affected

- Review WebLogic access logs for external POSTs to /PSEMHUB/hub and /PSIGW/HttpListeningConnector, especially requests carrying 127.0.0.1/localhost
- Look for unexpected .jsp files under PSEMHUB.war and new .xml files in envmetadata/data/environment/
- Search for README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT and *_fanout.sh scripts
- Hunt for MeshCentral agents (meshagent64-azure-ops.exe etc.) and traffic to azurenetfiles.net or 142.11.200.186-190

## What happened

On June 10, 2026, Oracle published an out-of-band [Security Alert for CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html), a flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. Oracle says it is "remotely exploitable without authentication" and "may result in remote code execution." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-35273) scores it CVSS 3.1 9.8. Oracle credits researchers from TrendAI and its Zero Day Initiative with reporting it.

By then the bug had been exploited for two weeks. [Mandiant and Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit) attribute exploitation between May 27 and June 9, 2026 to UNC6240, better known as ShinyHunters. They notified more than 100 organizations, mostly in the US, and 68% of them were universities and colleges. Stolen data was posted to the ShinyHunters leak site on June 9. The attackers themselves claimed about 300 PeopleSoft instances at more than 100 organizations, a figure [SecurityWeek](https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/) notes is unverified. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on June 12 with a three-day federal deadline, and flagged it as known to be used in ransomware campaigns.

Mandiant says the intrusions targeted the EMHub (`/PSEMHUB`) endpoints and used an SSRF-style technique through `/PSIGW/HttpListeningConnector`. Attackers then planted XMLDecoder-based persistence, installed MeshCentral agents disguised as Azure services, sprayed SSH credentials with a per-victim `_fanout.sh` script, and compressed the stolen data with zstd.

## Who is affected

Oracle lists PeopleTools 8.61 and 8.62 and warns that PeopleSoft Enterprise Applications customers "may also be affected." Higher education took the brunt through Campus Solutions deployments that hold student records, government IDs and financial aid data. The [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/) cites the University of Nottingham breach of about 454,600 student records as one public example.

## Do you really need to act?

Yes, if you are on 8.61 or 8.62 and the PeopleSoft Internet Architecture (PIA) is reachable from the internet, which is normal for student and employee self-service portals. The bug requires no credentials and no user interaction, a capable extortion group has already used it at scale, and the payoff is the kind of data that triggers breach notification laws.

One point of confusion: Oracle's alert talks about "mitigations" and links to a Patch Availability Document. SecurityWeek reported on June 11 that only mitigations appeared to be available. [Rapid7](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/) and CSA describe an emergency patch (referenced as CPU187). Check the Patch Availability Document for your exact release rather than assuming. Disabling EMHub and blocking the two paths is effective either way, and Mandiant says it does not break normal PIA sessions. Patching does not remove an attacker who got in during the May 27 to June 9 window, or later on unpatched systems.

## What to do now

1. Apply the fix from Oracle's CVE-2026-35273 Security Alert for your PeopleTools release.
2. Disable the EMHub service (multi-server) or remove the PSEMHUB application (single-server), as Oracle and Mandiant advise.
3. If you cannot disable it yet, block external access to `/PSEMHUB/*` and `/PSIGW/HttpListeningConnector`. Mandiant warns that WAF body-inspection rules alone can be bypassed.
4. Block outbound TCP 445 from PeopleSoft hosts. Mandiant says the chain may coerce SMB connections that leak machine-account NetNTLM hashes.
5. If you find indicators, rotate every credential stored on the PeopleSoft hosts (database connection strings, service accounts, SSH keys) and engage counsel on notification obligations.

## How to tell if you were hit

- WebLogic access logs showing external POSTs to `/PSEMHUB/hub` or `/PSIGW/HttpListeningConnector`, especially with loopback addresses in headers or parameters.
- Unexpected `*.jsp` files under `PSEMHUB.war/`, new files under `envmetadata/transactions/`, or recently modified `.xml` files under `envmetadata/data/environment/`.
- The marker file `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT`, or `*_fanout.sh` scripts.
- Mandiant IOCs: 142.11.200.186 through .190, `azurenetfiles.net`, 176.120.22.24, and MeshCentral agents named `meshagent64-azure-ops.exe`, `meshagent64-v2.exe` or `meshagent32-azure-ops.exe`.

## Timeline

- May 27, 2026 — Attacker C2 configured; exploitation begins (Mandiant).
- Jun 9, 2026 — Last observed exploitation in Mandiant's window; data posted to the leak site.
- Jun 10, 2026 — Oracle Security Alert published.
- Jun 11, 2026 — Mandiant/GTIG report published.
- Jun 12, 2026 — Added to CISA KEV (due June 15).

## Sources

1. [Oracle — Security Alert Advisory CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html)
2. [CVE.org — CVE-2026-35273](https://www.cve.org/CVERecord?id=CVE-2026-35273)
3. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
4. [Mandiant / Google Threat Intelligence — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit)
5. [Rapid7 — Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/)
6. [Cloud Security Alliance — Research Note: Oracle PeopleSoft Zero-Day](https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/)
7. [SecurityWeek — Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks](https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/)

---
Source page: https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt