ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
Summary
The critical Oracle PeopleSoft zero-day vulnerability, exploited by ShinyHunters since May, has been identified by researchers as a chain of three distinct flaws. Oracle addressed all three vulnerabilities under a single CVE identifier, CVE-2026-35273, with a patch released in June. The root cause is a server-side request forgery (SSRF) that exploits PeopleSoft's trust in its own loopback address to access an internal management interface.
IFF Assessment
This article details a critical zero-day vulnerability that has been actively exploited, posing a significant threat to organizations using Oracle PeopleSoft.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: June 15, 2026. Known ransomware use: Known.
Defender Context
Organizations using Oracle PeopleSoft should prioritize patching this vulnerability as it has already been exploited in the wild. Understanding the chained nature of the flaws, particularly the SSRF component, is crucial for defense-in-depth strategies and network segmentation.