#threatreport #MediumCompleteness Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273) | 12-06-2026 Source: https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273 Key details below ↓ 🧑💻Actors/Campaigns: Unc6240 (🧠motivation: cyber_criminal, information_theft) Shinyhunters (🧠motivation: cyber_criminal, information_theft) 💀Threats: Meshcentral_tool, Meshagent_tool, 🎯Victims: Higher education, Universities and colleges 🏭Industry: Telco, Education 🔓CVEs: CVE-2026-35273 \[[Vulners](https://vulners.com/cve/CVE-2026-35273)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: Unknown CVE-2013-3821 \[[Vulners](https://vulners.com/cve/CVE-2013-3821)] - CVSS V3.1: *6.4*, - Vulners: Exploitation: Unknown Soft: - oracle peoplesoft_products (8.51, 8.52, 8.53) CVE-2017-3548 \[[Vulners](https://vulners.com/cve/CVE-2017-3548)] - CVSS V3.1: *6.5*, - Vulners: Exploitation: Unknown Soft: - oracle peoplesoft_enterprise_peopletools (8.54, 8.55) 🤖LLM extracted TTPs:` T1036.005, T1071.001, T1187, T1190, T1219, T1560.001 🧨IOCs: - Url: 1 - IP: 6 - Domain: 1 - Hash: 5 - File: 1 💽Software: Linux #threatreport: CVE-2026-35273 is a critical vulnerability identified in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, which was publicly disclosed by Oracle on June 10, 2026. This vulnerability has been assigned a CVSSv3.1 score of 9.8 and is particularly concerning as it is remotely exploitable without authentication, allowing for potential remote code execution (RCE). The flaw has been characterized as a server-side request forgery (SSRF), and it specifically affects PeopleTools versions 8.61 and 8.62. Following the identification of this vulnerability, Oracle issued an out-of-band patch the same day. Prior to the Oracle advisory, active exploitation of this zero-day vulnerability was reported by Mandiant, tracking incidents from May 27 to June 9, 2026. This exploitation has been attributed to a financially motivated hacker group known as UNC6240, or ShinyHunters, which has a history of data theft and breaches targeting various sectors, notably higher education, where 68 percent of the compromised organizations were universities and colleges. The exploitation primarily centered around the Environment Management Hub (PSEMHUB) endpoints, with data stolen during this campaign being released on the ShinyHunters Data Leak Site shortly after the exploitation period. Technical analysis revealed two primary endpoints involved in the exploitation, namely /PSEMHUB/hub and /PSIGW/HttpListeningConnector. The exploitation chain could potentially lead to outbound SMB connections on TCP port 445, giving attackers the opportunity to intercept Windows machine account NetNTLM hashes. Activities following the initial compromise typically included the deployment of MeshCentral remote management agents disguised as Microsoft Azure services, enabling the attackers to maintain control and perform actions like internal reconnaissance, lateral movements, and data exfiltration using zstd compression techniques. For organizations leveraging exposure assessment tools such as Rapid7's, authenticated vulnerability checks regarding CVE-2026-35273 were made available shortly after the vulnerability was disclosed. Furthermore, security teams can utilize resources from the Rapid7 Intelligence Hub to stay updated with recent activities related to this vulnerability, including relevant indicators of compromise. Network indicators associated with the campaign included multiple IP addresses as well as a command and control domain, http://azurenetfiles.net, which masqueraded as a legitimate Microsoft Azure service.
Post summary
Rapid7’s threat report confirms that CVE‑2026‑35273 was actively exploited by UNC6240/ShinyHunters, detailing exploitation techniques, indicators of compromise, and the timely vendor patch.