ShinyHunters Chained Three PeopleSoft Flaws, Including CVE-2026-35273

Key points

• CVE-2026-35273 was one of a trio of linked PeopleSoft vulnerabilities.
• ShinyHunters used the chain to pivot via SSRF into internal-facing services.
• Oracle issued fixes across May and June.
• Public-sector and K-12 teams should verify patch status and restrict internal exposure.

ShinyHunters targeted Oracle PeopleSoft by combining a previously unknown vulnerability with two additional weaknesses, according to the available facts. The chain included CVE-2026-35273 and enabled server-side request forgery, which let the attackers reach services that were meant to stay on internal networks. The activity unfolded around May and June, with exploitation occurring before fixes were available.

Oracle patched the flaws, but the sequence matters: a single unpatched component can become a pivot point when linked to other defects. PeopleSoft is widely used for HR, finance, and campus administration, so deployments in government and education can hold sensitive identity and business data. Even where direct exploitation is not confirmed, exposure to internal interfaces raises the risk of lateral movement and data access.

Defenders should treat this as a patch-priority and exposure-reduction problem, not only a signature-matching exercise. The SSRF angle means outbound requests from application servers deserve scrutiny, especially to metadata endpoints, admin panels, and internal APIs. Logs from May and June should be reviewed for unusual request patterns, unexpected internal connections, and signs that a compromised app server was used as a bridge.

Because the campaign involved a zero-day, waiting for routine maintenance windows may have been too slow. Organizations should confirm which PeopleSoft instances are internet-facing, validate that Oracle's updates are applied, and check whether compensating controls were in place during the gap. Watch for follow-on activity such as new accounts, configuration changes, or access to internal services that should not be reachable from the application tier.

What to do now

1. Apply Oracle's PeopleSoft fixes for CVE-2026-35273 and related chain components immediately; prioritize internet-facing instances.
2. Inventory all PeopleSoft deployments and identify which expose web or integration endpoints to untrusted networks.
3. Block unnecessary outbound traffic from application servers and restrict access to internal admin and API endpoints using allowlists.
4. Review May-June logs for SSRF indicators: unusual outbound requests, internal IP connections, metadata-service calls, and anomalous app-server behavior.
5. Rotate credentials and secrets that were accessible from affected application servers if compromise is suspected.
6. Enable enhanced monitoring for new accounts, configuration changes, and lateral connections from PeopleSoft hosts.
7. Validate compensating controls and patch levels with a vulnerability scan or manual version check.

CVE references

• CVE-2026-35273

Original source

The Hacker News