Reported by 19 outlets
Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher Education
Why this score
- Breadth
- 2.00 / 2.0 · 19 sources
- Authority
- 2.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
ShinyHunters, tracked by Mandiant and Google Threat Intelligence Group as UNC6240, is running a second mass-exploitation wave against Oracle PeopleSoft servers vulnerable to CVE-2026-35273, a CVSS 9.8 unauthenticated Java deserialization RCE in PeopleTools 8.61 and 8.62 (Updates Environment Management component), reachable over HTTP without credentials. The group exploited the same flaw as a zero-day from May 27 to June 9, 2026, hitting more than 100 organizations, 68 percent of them US higher education. Oracle issued an out-of-band alert on June 10 and shipped the fix June 11.
The renewed campaign defeats the main workaround. Mandiant advised organizations that could not patch to block external access to the /PSEMHUB/ endpoint, and many did so with WAF rules. ShinyHunters now percent-encodes the path as /%50SEMHUB/, which literal-string WAF rules miss while the PeopleSoft server decodes it back. Mandiant observed repeated POST requests to /%50SEMHUB/hub to probe vulnerability, then Java deserialization deploying JSP web shells or fileless command execution. Confirmed and claimed victims span University of Nottingham, insurance regulator NAIC, Nissan (Social Security numbers, bank details, payroll records), American Tower (allegedly 5.2 million records including plaintext physical access codes for cell tower compounds), Madison Square Garden Sports (allegedly 26 million records), and a claimed FBI breach. The new wave extends past education into technology, healthcare, agriculture, transportation, government, and IT services.
Infrastructure from the June reporting still holds as detection material: MeshCentral v1.1.59 agents staged from 142.11.200.186 through 190 behind the domain azurenetfiles[.]net, a per-victim fanout bash script using stolen credentials, zstd-compressed exfiltration over SSH to 176.120.22.24, and extortion notes named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT dropped in WebLogic directories.
The lesson is that WAF rules are not patches. Any PeopleSoft estate that relied on path blocking instead of the June 11 update is exposed right now. Hunt for web shells and unauthorized XML in PeopleSoft and WebLogic directories, and watch for a third adaptation once encoded-path blocks spread.
Timeline
-
original reporting
Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher Education
bleepingcomputer.com · 124d ago · June 12th, 2026
Oracle published an out-of-band security alert for a critical unauthenticated RCE in PeopleSoft PeopleTools (versions 8.61, 8.62) — the same zero-day exploited by ShinyHunters (UNC6240) since late May. Mandiant and Google Threat Intelligence Group confirmed the exploitation window spans May 27 through June 9, 2026, and have notified over 100 organizations, 68% of which are in US higher education.
New technical details from Mandiant:
-
Entry vector: Exploitation of
/PSEMHUB/endpoints -
Staging: MeshCentral v1.1.59 agents on IPs 142.11.200[.]186–190, masquerading as Azure services via domain
azurenetfiles[.]net -
Lateral movement: Custom bash script (
[victim]_fanout.sh) using stolen/hardcoded credentials -
Exfiltration: Data compressed with
zstd, sent via SSH to 176.120.22[.]24 (ShinyHunters DLS) -
Extortion:
README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXTdropped in WebLogic directories
Action: Oracle has released mitigations only (patch pending). Disable PSEMHUB service or block external access to
/PSEMHUB/*and/PSIGW/HttpListeningConnector. Perform forensic review of PeopleSoft/WebLogic directories for webshells, unauthorized XML files, and the IOCs above. University IT teams should treat this as emergency priority. -
-
update from oracle.com
Oracle Security Alert Advisory - CVE-2026-35273
oracle.com · 126d ago · June 10th, 2026
Oracle's out-of-band Security Alert, initially released June 10, 2026, fixes CVE-2026-35273 in PeopleSoft Enterprise PeopleTools 8.61 and 8.62. The flaw is remotely exploitable without authentication over HTTP and leads to remote code execution, rated CVSS 9.8, in the Updates Environment Management component. Credit for the report goes to researchers at Trend Zero Day Initiative and Trend Research.
-
update from ny.gov
NYS ITS Advisory 2026-059 - A Vulnerability in Oracle PeopleSoft PeopleTools Could Allow for Remote Code Execution
ny.gov · 125d ago · June 11th, 2026
The advisory states the flaw allows an unauthenticated attacker with network access via HTTP to completely take over the software, affecting government and business entities at high risk. It references Bleeping Computer reporting on ShinyHunters data theft attacks targeting Oracle PeopleSoft servers against over 100 organizations, and links to Oracle's security alert.
-
update from malware.news
ShinyHunters Expands Beyond PeopleSoft — American Tower (5.2M Records Including Cell Tower Gate Codes) and Madison Square Garden (26M Records) Threatened With June 15 Leak
malware.news · 123d ago · June 13th, 2026
The ShinyHunters data-theft extortion campaign, already linked to the Oracle PeopleSoft zero-day (CVE-2026-35273) affecting 100+ organizations (covered June 11–12), has claimed two additional high-profile US victims with a June 15 leak deadline:
- American Tower Corporation: 5.2 million records allegedly compromised, including customer and landowner PII, GPS coordinates and plaintext physical access codes for cell tower compounds across the United States, data linked to T-Mobile, Verizon, and the US Department of Homeland Security, plus thousands of internal corporate records. This represents a potential physical security threat to critical communications infrastructure. - Madison Square Garden Sports Corp.: 26 million records allegedly compromised, including customer PII and internal corporate data. The American Tower breach — with physical cell tower access codes — raises the stakes beyond data theft to infrastructure access compromise. Rotate all physical access codes at affected sites as an immediate precaution.
-
update from thehackernews.com
Nissan Americas Confirms Oracle PeopleSoft Breach — Payroll Records, SSNs Exposed in Ongoing ShinyHunters Campaign
thehackernews.com · 107d ago · June 29th, 2026
Nissan Motor Co. has joined the growing list of Oracle PeopleSoft customers caught in the ShinyHunters exploitation wave, warning employees that Social Security numbers, bank account details, payroll records, and other personal data may have been stolen. In a filing submitted to the California Attorney General on Friday, Nissan Americas stated that Oracle had notified it of "a cyber event" involving the personnel records of hundreds of employees. Bottom line: Any organization running Oracle PeopleSoft should assume credentials and configuration data are compromised and treat the Oracle June 10 patch as urgent. The victim list continues to expand more than two weeks after the initial disclosure.
-
update from www.techmeme.com
ShinyHunters is actively exploiting a flaw in Oracle PeopleSoft — and according to Google, it is a renewed "mass exploitation". PeopleSoft
www.techmeme.com · 18d ago · September 26th, 2026
ShinyHunters is actively exploiting a flaw in Oracle PeopleSoft — and according to Google, it is a renewed "mass exploitation". PeopleSoft
via Mastodon https://www.techmeme.com/260925/p27#a260925p27
-
update from cloud.google.com
(cloud.google.com) ShinyHunters Renews Mass Exploitation Campaign Targeting Oracle PeopleSoft with WAF Bypass Techniques In brief - This art
cloud.google.com · 17d ago · September 26th, 2026
(cloud.google.com) ShinyHunters Renews Mass Exploitation Campaign Targeting Oracle PeopleSoft with WAF Bypass Techniques In brief - This art
via Mastodon https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
-
update from hackread.com
ShinyHunters is back, exploiting Oracle PeopleSoft, using URL encoding to bypass WAF rules on unpatched systems before deploying web shells
hackread.com · 17d ago · September 26th, 2026
ShinyHunters is back, exploiting Oracle PeopleSoft, using URL encoding to bypass WAF rules on unpatched systems before deploying web shells
via Mastodon https://hackread.com/shinyhunters-bypass-waf-rules-oracle-peoplesoft-attacks/
-
mentioned by thehackernews.com
🤖 CVE-2026-35273 (CVSS 9.8): unauthenticated Java deserialization RCE in Oracle PeopleSoft PSEMHUB. UNC6240 (ShinyHunters-linked) bypasses W
thehackernews.com · 17d ago · September 26th, 2026
-
mentioned by cyberworldops.eu
Google reports active exploitation of CVE-2026-35273 in Oracle PeopleSoft PeopleTools by UNC6240, linked to ShinyHunters. Encoded requests e
cyberworldops.eu · 17d ago · September 26th, 2026
-
update from bleepingcomputer.com
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
bleepingcomputer.com · 17d ago · September 26th, 2026
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. Google's Mandiant and Threat Intelligence Group (GTIG) say this new technique has allowed the threat actor to once again target PeopleSoft servers that had not applied security updates and instead blocked access to the vulnerable PSEMHUB endpoint using a WAF. Google also reported that same day that ShinyHunters, whom they track as UNC6240, was exploiting the CVE-2026-35273 flaw in attacks on the education sector, confirming BleepingComputer's reporting. However, in a new report , Google says ShinyHunters has now modified its exploit to bypass WAF rules that look for this literal path, rather than encoded versions of it.
-
mentioned by www.bleepingcomputer.com
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks https:// bleepingcomputer.com/news/security/ shinyhunters-uses-waf-bypass-tr
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
mentioned by www.bleepingcomputer.com
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks Source: BleepingComputer Read: https://www. bleepingcomputer.com/news/secu r
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
mentioned by thehackernews.com
🤖 Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) is being mass-exploited again by ShinyHunters. Attackers use URL-encoding
thehackernews.com · 17d ago · September 27th, 2026
-
mentioned by www.bleepingcomputer.com
Oracle PeopleSoft CVE-2026-35273 (unauth RCE) actively exploited: ShinyHunters percent-encodes path /%50SEMHUB/ to bypass WAF rules
www.bleepingcomputer.com · 16d ago · September 27th, 2026
-
mentioned by cloud.google.com
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft https:// cloud.google.com/blog/topics/th reat-intelligence/shiny
cloud.google.com · 16d ago · September 27th, 2026
-
mentioned by cloud.google.com
A WAF rule isn’t a patch. Mandiant says ShinyHunters bypassed PeopleSoft path blocks by encoding one character in the URL, then resumed expl
cloud.google.com · 16d ago · September 27th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells Vulnerability | CRITICAL CVEs: CVE-2026-
www.yazoul.net · 16d ago · September 27th, 2026
-
update from cybersecurefox.com
ShinyHunters claims FBI breach via Oracle PeopleSoft 🔗 https:// cybersecurefox.com/en/shinyhun ters-claims-fbi-breach-oracle-peoplesoft-cve-
cybersecurefox.com · 15d ago · September 28th, 2026
ShinyHunters claims FBI breach via Oracle PeopleSoft 🔗 https:// cybersecurefox.com/en/shinyhun ters-claims-fbi-breach-oracle-peoplesoft-cve-
via Mastodon https://cybersecurefox.com/en/shinyhunters-claims-fbi-breach-oracle-peoplesoft-cve-2026-35273
-
update from cyberpress.org
ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave
cyberpress.org · 15d ago · September 28th, 2026
ShinyHunters has resumed large-scale attacks against Oracle PeopleSoft , using a small change to its exploit to get past some web application firewall (WAF) rules. The latest targets span higher education, technology, IT services, healthcare, agriculture, transportation, and government. The sequence %50 represents the letter “P.” A WAF rule looking only for the literal /PSEMHUB/ path may miss the encoded request, while the PeopleSoft server decodes it and sends it to the vulnerable Environment Management Hub endpoint. Mandiant observed attackers sending repeated POST requests to /%50SEMHUB/hub to check whether servers were vulnerable. Successful attacks used Java deserialization to deploy JSP web shells or run commands directly without creating a file.
-
update from securityweek.com
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
securityweek.com · 15d ago · September 28th, 2026
An integrated enterprise resource planning (ERP) software suite, PeopleSoft is used across numerous large enterprises for the management of core business functions, including finance, HR, payroll, and supply chain. Google’s warning comes four months after the hacking group was seen exploiting a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273 , to gain remote code execution without authentication. Confirmed victims include the University of Nottingham in the UK, insurance regulators group NAIC , and Nissan . In the recent attack aimed at the FBI , ShinyHunters claimed to have leveraged a PeopleSoft zero-day.
-
update from gbhackers.com
Oracle PeopleSoft Servers Targeted Again as ShinyHunters Expands Extortion Operations
gbhackers.com · 15d ago · September 28th, 2026
The campaign demonstrates how quickly financially motivated actors can adapt when organizations rely on perimeter workarounds rather than applying vendor-issued […] The post Oracle PeopleSoft Servers Targeted Again as ShinyHunters Expands Extortion Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by linuxmint.hu
Google: attackers mass-exploit Oracle PeopleSoft CVE-2026-35273, bypassing WAFs with URL encoding
linuxmint.hu · 15d ago · September 28th, 2026
-
mentioned by theperimetersite.com
If you applied the workaround for CVE-2026-35273 and clocked out for the weekend, you're still at risk. Mandiant says ShinyHunters isn't jus
theperimetersite.com · 15d ago · September 28th, 2026
-
update from securityonline.info
ShinyHunters PeopleSoft attacks are back. A one-letter WAF bypass lets the group exploit CVE-2026-35273 and plant web shells on unpatched se
securityonline.info · 14d ago · September 29th, 2026
A one-letter WAF bypass lets the group exploit CVE-2026-35273 and plant web shells on unpatched se
via Mastodon https://securityonline.info/shinyhunters-peoplesoft-attacks/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by meterpreter.org
Discover how ShinyHunters uses URL encoding to bypass WAF defenses, aggressively exploiting the critical CVE-2026-35273 Oracle PeopleSoft vu
meterpreter.org · 14d ago · September 29th, 2026
-
update from reuters.com
ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google says
reuters.com · 14d ago · September 29th, 2026
submitted by /u/NISMO1968 [link] [comments]
via reddit r/cybersecurity: ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google says