Oracle PeopleSoft PeopleTools zero-day exploited by ShinyHunters (CVE-2026-35273)

On 10 June 2026, Oracle published an emergency, out-of-band security alert for CVE-2026-35273, a critical zero-day in the Environment Management component (PSEMHUB) of Oracle PeopleSoft Enterprise PeopleTools. The flaw had already been exploited in the wild for roughly two weeks by the data-extortion crew ShinyHunters, which Google's Mandiant tracks as UNC6240, to break into more than 100 organisations and steal their data.

What happened

CVE-2026-35273 carries a CVSS v3.1 base score of 9.8 and a vector (AV:N/AC:L/PR:N/UI:N) describing a flaw that an unauthenticated attacker can exploit remotely over the network with no user interaction, resulting in remote code execution. It affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Because the bug lives in an internet-facing management component, a single unauthenticated request was enough to give attackers code execution on exposed servers.

Mandiant reported that exploitation ran from 27 May 2026 through 9 June 2026 — before Oracle's advisory existed, making this a true zero-day. After gaining a foothold, the attackers mapped PeopleSoft configurations and internal network topology, moved laterally using a custom propagation script and SSH credential spraying, dropped extortion marker files (README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT), and exfiltrated compressed data using zstd. Stolen datasets began appearing on the ShinyHunters leak site on 9 June.

Impact

• A critical (CVSS 9.8) unauthenticated remote-code-execution zero-day in PeopleTools 8.61 and 8.62.
• More than 100 organisations notified by Mandiant, the majority based in the United States.
• 68% of the affected organisations operated in higher education — universities and colleges that run PeopleSoft for student, HR, and finance systems.
• Confirmed data theft and extortion-site publication rather than file-encrypting ransomware.
• Oracle released a fix and urged customers to patch immediately and review exposed PeopleSoft instances for compromise.

Why it matters

PeopleSoft is the back-office backbone for a large share of the world's universities and large enterprises, holding student records, payroll, and financial data — exactly the bulk personal information that an extortion group can monetise. The campaign is another example of ShinyHunters pivoting to mass exploitation of a single enterprise-software zero-day, echoing earlier cohorts built around Salesforce and SharePoint data theft. The lesson is a familiar one: an internet-exposed management component running an unauthenticated code path is a standing invitation, and the window between first exploitation and vendor advisory — here about two weeks — is more than enough time to empty a database.