Oracle PeopleSoft Zero-Day CVE-2026-35273 Actively Exploited

Executive Summary: A Critical Threat to Enterprise Systems

A critical, unauthenticated remote code execution (RCE) zero-day vulnerability, tracked as CVE-2026-35273, is under active exploitation in Oracle PeopleSoft environments. The financially motivated extortion group ShinyHunters, tracked by Mandiant as UNC6240, has leveraged this flaw in a widespread campaign primarily targeting the higher education sector. The campaign, observed between late May and early June 2026, resulted in the compromise of over 100 organizations and significant data theft.

This vulnerability carries a CVSS 3.1 base score of 9.8 (Critical), reflecting its ease of exploitation and profound impact on confidentiality, integrity, and availability. Oracle has released an out-of-band security advisory and patch. However, due to the nature of the exploitation, immediate patching is insufficient. Organizations must assume compromise and initiate proactive threat hunting.

This BreachModal intelligence report provides a complete analysis of the vulnerability, the threat actor's tactics, and a definitive guide to mitigation and remediation.

> 🧠 CISO Brief: CVE-2026-35273 represents a severe and immediate risk to business operations. PeopleSoft is a core ERP system, housing mission-critical data including PII, financial records, and intellectual property. A compromise leads not only to data extortion but also to operational paralysis and severe reputational damage. The targeting of universities underscores the value of their data to threat actors. This incident must trigger an immediate review of security controls around all internet-facing enterprise applications, not just PeopleSoft.

Vulnerability Analysis: CVE-2026-35273 Dissected

Understanding the mechanics of the vulnerability is foundational to effective defense.

Technical Profile CVE-2026-35273 is a remote code execution vulnerability within the Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, specifically the PSEMHUB service. The flaw's critical nature stems from several factors:

* No Authentication Required: An attacker can exploit the vulnerability without any credentials. * No User Interaction: The attack does not require a user to click a link, open a file, or perform any other action. * Network Exploitability: The attack can be launched over a network via a standard HTTP request. * Total System Takeover: Successful exploitation grants the attacker full control over the PeopleSoft Enterprise PeopleTools instance, enabling arbitrary code execution with the privileges of the application server.

This combination makes the vulnerability a prime target for automated, widespread scanning and exploitation.

Affected Systems and Scope The vulnerability is confirmed to affect Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. Oracle's advisory notes that earlier, unsupported versions are also likely vulnerable, expanding the potential attack surface to any organization that has not maintained a rigorous patching cadence.

Threat Actor Profile: ShinyHunters (UNC6240)

ShinyHunters is a well-established cybercrime group known for large-scale data breaches and subsequent extortion. Historically, their modus operandi has focused on credential stuffing, exploiting misconfigurations, and social engineering to gain access. They typically exfiltrate large volumes of data and then attempt to sell it on dark web forums or extort the victim organization.

> ⚠️ BreachModal Insight: The CVE-2026-35273 campaign marks a significant tactical evolution for ShinyHunters. Their use of a server-side, on-premises ERP zero-day demonstrates a maturation of capability, moving from opportunistic attacks to more sophisticated, targeted intrusions. This shift aligns with a broader trend among top-tier extortion groups who are increasingly investing in developing or acquiring zero-day exploits to bypass perimeter defenses and strike high-value targets directly.

Their financial motivation remains constant, but their methods are becoming more aligned with state-sponsored actors, blurring the lines and increasing the defensive challenge for organizations.

[Visual Graphic 1: A flowchart illustrating the complete attack chain, from initial exploit of CVE-2026-35273 to final data exfiltration via SSH.]

The Attack Chain: From Initial Access to Exfiltration

Mandiant's investigation provides a clear timeline of the attacker's methodology. The attack is not a single action but a multi-stage process designed for stealth, persistence, and maximum impact.

Stage 1: Initial Compromise The attackers initiated the compromise by targeting public-facing PeopleSoft instances. They leveraged a sophisticated 'gadget chain' that combined older, known vulnerabilities with the CVE-2026-35273 zero-day. This chain allowed them to bypass existing security measures and execute code remotely by sending crafted HTTP POST requests to the `/PSEMHUB/hub` endpoint.

Stage 2: Persistence and Command & Control (C2) Once initial access was secured, UNC6240 deployed a customized version of the MeshCentral remote management tool. To evade detection, the C2 agent was disguised as a legitimate Microsoft Azure binary. This agent established a persistent connection to attacker-controlled infrastructure, giving them sustained remote control over the compromised server.

Stage 3: Lateral Movement With a foothold established, the attackers used a custom shell script named `[victim]_fanout.sh`. This script was designed to move laterally across the victim's network. It contained hardcoded usernames and passwords, which it used to attempt SSH connections to other internal hosts. This password-spraying technique is noisy but effective in environments with weak internal credential policies.

Stage 4: Data Staging and Exfiltration Before exfiltration, the attackers identified and aggregated sensitive data. They used the `zstd` compression algorithm to package the stolen data into smaller archives, likely to speed up the exfiltration process and reduce the network footprint. The compressed data was then exfiltrated via outbound SSH connections to servers associated with the ShinyHunters leak site infrastructure. As a final step, they dropped a marker file named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` in PeopleSoft directories.

> 🧩 Tactical Note: Security teams must hunt for the following specific Indicators of Compromise (IoCs) associated with this campaign: > * Network Logs: External POST requests to `/PSEMHUB/hub` or `/PSIGW/HttpListeningConnector` in WebLogic access logs. > * File System: * Unexpected `.jsp` files within the `PSEMHUB.war` web application directory. * Suspicious folders named `logs`, `persistantstorage`, or `scratchpad` under PSEMHUB paths. * Recently modified `.xml` files in `envmetadata/data/environment`. * Presence of the file `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT`. > * Network Traffic: Outbound SMB traffic (port 445) or SSH traffic (port 22) from PeopleSoft hosts to unknown external destinations. > * Known Attacker IPs: * `142.11.200[.]186–190` * `108.174.202[.]99` * `176.120.22[.]24`

Strategic Mitigation and Hardening Guidance

A multi-layered defense is required to counter this threat. Response actions must be executed in parallel: containment, eradication, and long-term hardening.

Immediate Remediation

1. Apply the Patch: This is the first and most critical step. Deploy the security update provided by Oracle for PeopleTools versions 8.61 and 8.62 immediately. Access the patch via My Oracle Support.

2. Isolate or Remove the Vulnerable Component: If patching cannot be performed immediately, implement compensating controls. * Multi-server setups: Disable the Environment Management Hub service. * Single-server setups: Remove the PSEMHUB application entirely.

3. Implement Network Controls: If the component cannot be disabled, block all external access to the vulnerable endpoints at your network perimeter (firewall, load balancer, reverse proxy). Specifically, deny traffic to `/PSEMHUB/*` and `/PSIGW/HttpListeningConnector`. Mandiant warns that Web Application Firewall (WAF) body-inspection rules alone may be insufficient to block the exploit chain.

Proactive Threat Hunting

Given the zero-day nature of this campaign, organizations must assume they were compromised before the patch was available. Threat hunting is not optional.

* Review Logs: Scrutinize WebLogic, Apache, and other web server access logs for requests to the PSEMHUB endpoints from external IP addresses, dating back to at least May 2026. * Analyze File Systems: Perform integrity checks on PeopleSoft application directories. Search for any files created or modified by the application's service account that are not part of a legitimate deployment or patch. * Monitor Network Egress: Analyze firewall and NetFlow logs for any outbound SSH or SMB connections originating from your PeopleSoft servers. This is a primary indicator of data exfiltration or lateral movement.

Long-Term Defense Posture

This incident should serve as a catalyst for strategic security improvements.

* Adhere to Federal Directives: CISA has added CVE-2026-35273 to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies are required to patch under BOD 22-01 and BOD 26-04. All organizations should use the KEV catalog as a prioritization tool for their vulnerability management programs. * Principle of Least Privilege: Ensure the PeopleSoft application service accounts have the minimum necessary permissions to function. They should not have broad access to the underlying operating system or other network resources. * Network Segmentation: Internet-facing application servers should be in a strictly controlled DMZ, with explicit firewall rules dictating what internal resources they can access. Egress traffic should be denied by default and only allowed for specific, documented business needs.

FINAL VERDICT

CVE-2026-35273 is a highly severe vulnerability that was weaponized by a capable threat actor before a patch was available. The ShinyHunters campaign demonstrates a clear and present danger to any organization running vulnerable versions of Oracle PeopleSoft. The impact extends beyond data theft to include significant operational disruption and reputational harm, particularly within the heavily targeted higher education sector.

Reactive measures like patching are essential but represent only one part of a comprehensive defense. Organizations must immediately pivot to a proactive stance, combining patching with aggressive threat hunting and strategic hardening of their enterprise application infrastructure. Failure to do so leaves the door open to an adversary that has already proven its ability to bypass perimeter defenses.

Your organization’s security posture is being tested. To validate your defenses against advanced threats like the UNC6240 campaign and hunt for hidden compromises, engage BreachModal’s Adversarial Simulation and Breach Response teams today.