KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-35273
9.8
3-Day Required
KEV
Automatable
Active Exploitation
Details
VulnerabilityOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
VendorOracle
ProductPeopleSoft Enterprise PeopleTools
Date added2026-06-12
Due date2026-06-15
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-918
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-26 03:41 UTC
Wall time0.5s
Searches6
Component defaultyes
Sources
https://www.hivepro.com/threat-advisory/oracle-peoplesoft-under-siege-zero-day-cve-2026-35273-fuels-shinyhunters-intrusions/
https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
https://arcticwolf.com/resources/blog/critical-oracle-peoplesoft-vulnerability-actively-exploited-in-shinyhunters-campaign/
https://www.esentire.com/security-advisories/oracle-peoplesoft-zero-day-vulnerability-cve-2026-35273-exploited-by-shinyhunters
https://threatprotect.qualys.com/2026/06/18/cve-2026-35273-defending-against-the-oracle-peoplesoft-psemhub-authentication-bypass/
https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html
https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
https://arcticwolf.com/resources/blog/critical-oracle-peoplesoft-vulnerability-actively-exploited-in-shinyhunters-campaign/
https://www.esentire.com/security-advisories/oracle-peoplesoft-zero-day-vulnerability-cve-2026-35273-exploited-by-shinyhunters
https://threatprotect.qualys.com/2026/06/18/cve-2026-35273-defending-against-the-oracle-peoplesoft-psemhub-authentication-bypass/
https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html
https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
Hunting hypothesis agent
Hunt proxy logs for POST /PSIGW/HttpListeningConnector with ConnectorParam referencing localhost/PSEMHUB/hub and monitor envmetadata/transactions/ or envmetadata/data/environment/ for writes indicating SSRF pivot and XMLDecoder persistence.
Research details
ComponentUpdates Environment Management Hub (PSEMHUB) servlet at /PSEMHUB/hub, accessed via the Integration Broker gateway PSIGW at /PSIGW/HttpListeningConnector
Preconditions['PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected, including installations fully patched before the June 10 out-of-band advisory', 'The Integration Broker gateway (/PSIGW/HttpListeningConnector) must be exposed to untrusted networks', 'No authentication or prior access required — the PSEMHUB IP allow-list (validateClient) is bypassed when the gateway issues a loopback request to itself', 'HTTP access on the PeopleSoft web server port is required', 'The Integration Broker service must be enabled and listening', 'The exploit writes attacker-controlled XML under envmetadata/data/environment/ and triggers code execution on the next web-tier restart via XMLDecoder deserialization'] agent
DeliveryUnauthenticated HTTP POST to /PSIGW/HttpListeningConnector containing an IBRequest XML body with a ConnectorParam URL pointing to http(s)://localhost/PSEMHUB/hub. The gateway relays the request as a loopback, bypassing the PSEMHUB IP allow-list. A second request through the hub writes attacker-controlled XML to envmetadata/data/environment/, which is deserialized to code execution on the next web-tier restart.
Public PoCno
Exploit notesCVSS 9.8 (Critical) with low attack complexity. No public weaponized exploit code has been identified, but multiple detailed technical analyses describe the full chain step by step (Trend Micro ZDI, Mandiant/GTIG, Rapid7, Arctic Wolf). The chain was exploited in-the-wild as a zero-day by ShinyHunters (UNC6240) from May 27 through June 9, 2026, targeting over 100 organizations primarily in higher education. The final code-execution step is behaviorally quiet: it runs inside the WebLogic JVM on a web-tier restart with no spawned child process and no required outbound beacon, making detection by conventional behavioral or network sensors extremely difficult.
SummaryOracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a pre-authentication SSRF-to-RCE chain (CVSS 9.8) in the Integration Broker gateway (PSIGW) and Environment Management Hub (PSEMHUB). An unauthenticated attacker sends an IBRequest XML POST to /PSIGW/HttpListeningConnector with a ConnectorParam URL pointing to localhost/PSEMHUB/hub. The gateway relays the request as a loopback, satisfying the PSEMHUB IP allow-list and granting access to the internal management servlet. The attacker writes a crafted XML payload under envmetadata/data/environment/ that is deserialized by XMLDecoder on the next web-tier restart, yielding RCE as the web-tier service account (SYSTEM on Windows, psadm2 on Unix). The chain was actively exploited as a zero-day by ShinyHunters (UNC6240) against over 100 education-sector organizations before Oracle released an out-of-band patch on June 10, 2026.
Tia coverage
First reported2025-08-26
First exploit report2026-06-12
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
citrix-netscaler-unpatched-rce-zero-daysdutch-police-arrest-reformed-hacker-in-shiny-hunters-investigatioracle-e-business-suite-critical-flaw-cve-2026-46817-now-exploitoracle-peoplesoft-cve-2026-35273-cvss-9-8-mitigations-released-moracle-s-second-monthly-cspu-delivers-245-patches-120-critical-1september-2026-cve-landscapeshinyhunters-claims-theft-of-297gb-of-council-of-europe-data-jun
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.