Oracle PeopleSoft CVE-2026-35273: How an SSRF Bug Became an Unauthenticated RCE — and Why ShinyHunters Hit 100+ Organizations

The watchdog that opened the door

For two weeks before anyone had a name for it, a critical bug in Oracle PeopleSoft was already being used to take over servers. Between May 27 and June 9, 2026, an extortion crew tracked by Google’s Mandiant as UNC6240 — better known as ShinyHunters — quietly walked into more than 100 organizations through their HR and student-records systems. Oracle did not publish an advisory until June 10, which means the flaw, now catalogued as CVE-2026-35273, was a true zero-day the entire time it was being weaponized. CISA added it to the Known Exploited Vulnerabilities catalog within days.

The damage was concentrated where it hurts most: 68% of the notified organizations were universities and colleges, most in the United States. One of the first confirmed victims, the University of Nottingham, appears in a leaked dataset containing roughly 455,000 unique email addresses spanning current students and alumni. If your organization runs PeopleSoft for HR, payroll, financials, or campus solutions, this is not a “patch it next cycle” item.

Technical analysis: an SSRF that escalates to code execution

CVE-2026-35273 carries a CVSS v3.1 base score of 9.8 (Critical) and is remotely exploitable without authentication and without user interaction — the worst combination on the scorecard. All an attacker needs is HTTP network access to the vulnerable endpoint.

The root cause is a Server-Side Request Forgery (CWE-918) in the Updates Environment Management component — specifically the machinery behind the Environment Management Hub (PSEMHUB). SSRF on its own is often treated as a medium-severity nuisance: you trick a server into making requests it should not. But in this case the SSRF primitive is the on-ramp to remote code execution. Once an attacker can coerce the PeopleSoft server into issuing crafted internal requests, they pivot that capability into running code on the host. The lesson security teams keep relearning in 2026 is that SSRF is rarely “just” SSRF when the affected service sits deep inside an application tier with privileged internal reachability.

The attack chain observed in the wild went well beyond a single exploit:

• Initial access via the PSEMHUB / PSIGW HTTP listening connector endpoints.
• Foothold using customized MeshCentral agents disguised as legitimate cloud endpoints, giving operators a remote-administration channel that blends into normal outbound traffic.
• Lateral movement through a custom script that sprayed a hardcoded list of usernames and passwords over SSH, pulling target hosts from the compromised server’s /etc/hosts file.
• Impact and intimidation — the script dropped a marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into PeopleSoft directories, and stolen data was published on the ShinyHunters Data Leak Site.

This is a textbook exploitation-to-extortion pipeline: get in through one unauthenticated bug, establish a quiet persistence layer, fan out internally with cheap credential spraying, then monetize through data theft and public leak-site pressure.

Impact assessment

Risk rating: Critical. The combination of unauthenticated RCE, a two-week zero-day window, confirmed mass exploitation, and a financially motivated actor with a working data-leak operation makes this one of the most consequential enterprise-application flaws of the quarter.

Who is exposed. Any internet-reachable PeopleSoft deployment running the affected PeopleTools releases is in scope. The education sector took the brunt of it, but PeopleSoft underpins HR, payroll, and finance for governments, healthcare systems, and large enterprises too. The data at risk — personal records, academic records, employee PII — is exactly the material that fuels downstream fraud, phishing, and secondary extortion.

Why it spread so fast. PeopleSoft environments are notoriously long-lived and customized, which makes them slow to patch and easy to lose track of. Many organizations expose management components like PSEMHUB far more broadly than they intend, often because a multi-server topology was stood up years ago and never re-segmented. An unauthenticated bug plus over-exposed management endpoints plus a slow patch cadence is precisely the soil mass-exploitation campaigns grow in.

The CloudShieldSecure perspective

What turned a single SSRF bug into a 100-organization breach was not the exploit alone — it was a lack of visibility into which management endpoints were reachable, and from where. Most victims did not know that /PSEMHUB/* and /PSIGW/HttpListeningConnector were exposed to the internet until the marker file showed up.

This is the exact gap CloudShieldSecure is built to close. By continuously mapping internet-facing services against known-exploited vulnerabilities and flagging management interfaces that should never be publicly reachable, the platform surfaces the exploitable exposure — not just a raw CVE list — and ties it to a clear remediation owner. When a CVE like 2026-35273 lands in CISA KEV, the question every team should be able to answer in minutes is “do we run this, and is it reachable?” CloudShieldSecure is designed so that answer is already on the dashboard before the advisory drops, with exception tracking and evidence history for the endpoints you knowingly accept. Continuous external attack-surface visibility is what shrinks a two-week zero-day window from “company-ending” to “Tuesday.”

Recommended actions

If you run Oracle PeopleSoft, work through this checklist now:

1. Apply Oracle’s out-of-band patch for CVE-2026-35273 immediately. Oracle released it the same day as the June 10 advisory. Treat it as emergency change, not routine maintenance.
2. If you cannot patch right away, mitigate. Disable the Environment Management Hub (EMHub) Service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations.
3. Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter/firewall if the service cannot be disabled.
4. Hunt for compromise. Search for the marker file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, unexpected MeshCentral agents, anomalous outbound connections, and SSH brute-force patterns against internal hosts.
5. Rotate credentials for any account reachable from the PeopleSoft host, and review /etc/hosts and SSH access on adjacent systems given the spraying behavior.
6. Reduce the attack surface permanently. Management and integration endpoints should never be internet-reachable. Re-segment, put them behind VPN/zero-trust access, and verify with an external scan.
7. Assume data exposure if you find indicators, and engage your IR and legal teams for breach-notification obligations — especially in education and other regulated sectors.

Sources & references

• Oracle Security Alert Advisory — CVE-2026-35273
• The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day
• Google Cloud / Mandiant — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
• Rapid7 — Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
• Help Net Security — Oracle PeopleSoft under attack, out-of-band alert
• BleepingComputer — Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
• SecurityAffairs — CISA adds Oracle PeopleSoft flaw to KEV

CloudShieldSecure is a cybersecurity platform by CloudKonsult Limited. Learn more at cloudshieldsecure.cloudkonsult.cloud.

#CloudShieldSecure