Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters
Summary
Google has confirmed that the ShinyHunters threat actor group is exploiting a zero-day vulnerability in Oracle PeopleSoft. Oracle has taken steps to mitigate the vulnerability, identified as CVE-2026-35273, although they have not officially confirmed its in-the-wild exploitation.
IFF Assessment
The exploitation of a zero-day vulnerability by a known threat actor poses a direct risk to organizations using the affected software.
Severity
Defender Context
This incident highlights the ongoing threat of zero-day exploits against enterprise software, particularly from well-known threat groups like ShinyHunters. Defenders should be vigilant for signs of exploitation and prioritize patching or implementing mitigating controls for Oracle PeopleSoft deployments as soon as vendor guidance is available.