ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution without a login.

Vulnerability Breakdown

The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle. In its analysis, ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each. As of this week, the one June identifier is still the only one on the record.

Attack Campaign

Oracle released its fix in an out-of-band security alert on June 10. The flaw is on CISA's Known Exploited Vulnerabilities catalog. Attackers were already using it before that fix was in place. Mandiant and Google Threat Intelligence Group attribute a campaign to the group it tracks as UNC6240, better known as ShinyHunters, that exploited the flaw between May 27 and June 9, mostly against universities.

In a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.

Technical Details

ZDI's analysis explains what that single patch actually closed. Two PeopleSoft components are involved: the Integration Gateway (PSIGW) and the Environment Management Hub (PSEMHUB). The first flaw is the SSRF in PSIGW, which allows an attacker to control both the address it forwards to and the full payload.

PSEMHUB decides who to trust by checking against a file named allowedhosts.properties, which includes the local loopback address 127.0.0.1 by default. An attacker points the SSRF at 127.0.0.1, making the request appear to come from the machine itself, bypassing security checks.

From there, ZDI described two ways to turn that access into code execution: one abuses a PSEMHUB command to write a web shell, while the other writes a malicious XML file that runs code when the service starts. The design decision at the center is that allowing loopback access by default makes the trust check ineffective once the SSRF exists.

Evasion Tactics

In the September wave, Mandiant found ShinyHunters slipping past web application firewall (WAF) rules by url-encoding a single character, requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF rules match the path's plain text, while the PeopleSoft server decodes it and serves the page.