CVE-2026-35273Active Exploitation(oracle / peoplesoft_enterprise_peopletools)

🚨 ShinyHunters resumes mass exploitation of critical Oracle PeopleSoft flaw using simple WAF bypass. Mandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters. ⠀ The critical vulnerability allows unauthenticated remote code execution in Oracle PeopleSoft PeopleTools and carries a CVSS score of 9.8. Oracle released an emergency patch on June 10. ⠀ The new campaign targets organizations that attempted to mitigate the flaw using web application firewall rules but did not install the patch. ShinyHunters bypassed rules blocking the vulnerable /PSEMHUB/ endpoint by encoding a single character and sending requests to /%50SEMHUB/. ⠀ Google says web shells were deployed on dozens of systems worldwide across: • Higher education • Technology • IT services • Healthcare • Agriculture • Transportation • Government ⠀ The actors deployed web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tools and MeshAgent for persistent remote access. Around one-quarter of the observed commands executed with root or SYSTEM privileges. ⠀ Organizations running PeopleSoft should patch immediately, disable or remove the Environment Management Hub where possible and investigate encoded variants of /PSEMHUB/ in access logs. WAF rules alone are not sufficient.

Seems highly likely this was the vuln used to hack the FBI. CVE-2026-35273 - Missing Authentication for Critical Function It came out June 11th and was immediately added to the CISA Known Exploited list - which means it was seen in real world attacks all the way back then. https://t.co/hxofw3cB4K

Noise, hysteria, confusion, and AI slop surround CVE-2026-35273 - we believe this is the first-stage SSRF in the Oracle PeopleSoft RCE chain being flung around. We will share the full chain when we feel the time is right, and when we're bored of the vibecoded PoCs. Speak soon. https://t.co/XLLvVeSfh8

🚨 One URL-encoded character is helping attackers bypass WAF rules protecting Oracle PeopleSoft. UNC6240/ShinyHunters is exploiting CVE-2026-35273 to deploy web shells on dozens of systems, then using post-exploitation tools including SIDEEYE. Read: https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html

🚨 ShinyHunters is exploiting an Oracle PeopleSoft vulnerability (CVE-2026-35273) as part of an extortion campaign targeting higher education. Read the full analysis, and get IOCs and remediation guidance to stay ahead of the threat: https://goo.gle/4e52jOz https://t.co/PFZZbYa6II

ShinyHunters is exploiting Oracle PeopleSoft CVE-2026-35273 Another popular ShinyHunters tactic is using victim-specific subdomains Here is one recently reregistered being used with an interesting old subdomain: /support.report (live) /apple.support.report @apple https://t.co/4rbiHOH6Sj

🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation. Source IPs and the full indicators are available on Defused Radar. http://console.defusedcyber.com/signup

Found an open directory hosting a layered financial fraud operation across three simultaneous tracks: a Magecart-style card skimmer chain, a mass CVE exploitation framework, and a trojan distributed through Chinese streaming software packaging. All of it feeding the same PII collection pipeline. The skimmer track starts with FOFA. The actor runs automated queries targeting WooCommerce, Magento, and Stripe-integrated checkout pages, sorting results into structured target lists by category: builder_woo_checkout, stripe_woo_checkout, magento_checkout, checkout_cdn_js. Output lands in pii_consolidated.csv, with a second batch file visible alongside it. This has been running in passes. The skimmer component is a WooCommerce and Stripe-targeted Magecart payload. Injection engine supports page-level download, mitmproxy transparent proxy, and browser console delivery. C2 receiver runs on the same host. Target profile: Stripe Elements checkout pages, WooCommerce wc-ajax endpoints. The exploitation track runs in parallel. poc_scanner.py drives 300 concurrent probes against FOFA-sourced targets through a three-stage pipeline: liveness check, service fingerprinting, then PoC verification. CVEs being actively weaponized: CVE-2026-21858 — n8n unauthenticated RCE, CVSS 10.0 CVE-2026-6815 — Casdoor path traversal to RCE, CVSS 9.8 CVE-2026-32604 — Spinnaker shell injection, CVSS 10.0 CVE-2026-34486 — Tomcat Tribes auth bypass to RCE, CVSS 9.8 CVE-2026-25212 — Percona PMM RCE, CVSS 9.9 CVE-2026-35273 — PeopleSoft unauthenticated SSRF to RCE, CVSS 9.8 CVE-2026-23744 — MCPJam Inspector unauthenticated RCE, CVSS 9.8 CVE-2026-42167 — ProFTPD CVE-2026-6182 — SQL injection auth bypass CVE-2025-24587, CVE-2025-4396 A separate WordPress track runs alongside: mass SQL injection via wp_sqli_mass.py, aggressive dump via wp_aggressive_dump.py, PhpMyAdmin brute-force against the same pool. The trojan track is socially engineered. 直播助手化.v2.exe presents as a legitimate Chinese streaming helper application. VMProtect 3.2–3.5 wrapping. 29/70 on VirusTotal at time of analysis. Family: flystudio, chinad, dlii. It ships with HPSocket4C.dll, pb.dll, pb64.dll, and gzip.dll as side-loaded components. The infection surface is Chinese-speaking streaming users who would recognize the product name as familiar tooling. C2 routes through v2ray. Two license spoofing servers complete the toolkit. bypass_server.py impersonates http://premium.dotbypasser.workers.dev, handling RSA-OAEP encrypted license exchange and returning forged validation responses with 10-year expiry timestamps. fake_auth_server.py covers a separate streaming platform, impersonating http://api.vmks.cn and related domains, returning fake authorization tokens. Both appear to serve tooling distribution rather than direct victim infrastructure. One additional finding on the C2 host: evidence of AI-assisted offensive operations. A DeepSeek API configuration points to http://api.deepseek.com through an Anthropic-compatible interface, and a structured offensive security framework containing 70+ purpose-built skill modules for vulnerability classes including SQLi, XSS, SSRF, RCE, IDOR, OAuth, SAML, cloud misconfiguration, Kubernetes, CI/CD, M365/Entra, VMware vCenter, and supply chain recon. The actor is running systematized, AI-assisted attack methodology. This pattern is increasingly documented across financially motivated operations. OPSEC failure on an otherwise capable operator. filter_cn.py is on the box and actively used. It strips Chinese IP ranges from FOFA output sets before exploitation runs begin. The actor is deliberately skipping domestic targets, a consistent behavioral marker across Chinese financially motivated operations. Additionally, the FOFA API credential is hardcoded in cleartext across the client scripts. Easy attribution anchor.

🚨 A new ransomware-linked vulnerability has recently been added to DarkFeed's CISA KEV monitoring. CVE-2026-35273 affects Oracle PeopleSoft Enterprise PeopleTools and allows unauthenticated attackers to potentially gain control over vulnerable systems. The vulnerability is already listed in CISA's Known Exploited Vulnerabilities catalog and has been associated with ransomware activity. Organizations using PeopleSoft should prioritize patching and exposure assessment. #CyberSecurity #Ransomware #Oracle #PeopleSoft #CVE #ThreatIntelligence #KEV

🚨 GOOGLE/MANDIANT: SHINYHUNTERS RENEWS MASS EXPLOITATION OF ORACLE PEOPLESOFT FLAW CVE-2026-35273 Mandiant and Google Threat Intelligence Group (GTIG) report a new wave of mass exploitation of Oracle PeopleSoft CVE-2026-35273 by UNC6240 (ShinyHunters). The group first used the flaw as a zero-day against universities between May 27 and June 9; Oracle issued an out-of-band Security Alert on June 10. Key findings from GTIG (Sept. 25): • WAF bypass: requests to /%50SEMHUB/ instead of /PSEMHUB/ (one URL-encoded character) slip past string-based WAF rules, while WebLogic decodes the path and serves the vulnerable Environment Management Hub servlet • Java deserialization in the PSEMHUB hub servlet, used for web shells (x.jsp, u.jsp) or fileless command execution • Web shells on dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transportation and government • Follow-on tooling: SIDEEYE backdoor hidden in a trojanized, EV-signed "Ple64.exe" installer, the Neo-reGeorg tunnel and MeshAgent RMM • A quarter of observed commands ran as root or SYSTEM • Sample IOCs: 5.199.162[.]157, 104.219.234[.]138, 162.219.30[.]165, winmanage-me[.]network ⚠️ Analyst Note: WAF rules are not a patch. Apply Oracle's CVE-2026-35273 fix, disable or remove EMHub/PSEMHUB, search logs for any encoded variant of /PSEMHUB/, and rotate credentials the PeopleSoft tier can reach. GTIG warns victims to prepare for data-theft extortion. GTIG report: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/ #DDW #DarkWeb #ShinyHunters #UNC6240 #Oracle #PeopleSoft #CVE202635273 #Mandiant #ThreatIntelligence #CyberSecurity

🚨 We've reversed CVE-2026-35273 and released a Rapid Response test. This is a critical unauthenticated RCE in Oracle PeopleSoft PeopleTools. https://t.co/FIYQYoejT4

🚨 A critical Oracle PeopleSoft zero day tracked as CVE-2026-35273 (CVSS 9.8) allows unauthenticated attackers to achieve remote code execution. The vuln is being exploited in data theft attacks by ShinyHunters. ~300 Oracle PeopleSoft instances exposed to the internet at the time of sending this post: https://www.shodan.io/search?query=http.title%3A%22Oracle+PeopleSoft+Sign-in%22 Any exposed instance is at elevated risk and should be investigated as a priority. IoCs can be found in the thread below. Mitigations are available. A full patch is expected imminently. https://www.oracle.com/security-alerts/alert-cve-2026-35273.html#AppendixPS

# CVE-2026-35273 - Oracle PeopleSoft Environment Management Hub Exploitation Kit # Overview CVE-2026-35273 is a critical, unauthenticated remote code execution vulnerability in the **Updates Environment Management** component of Oracle PeopleSoft Enterprise PeopleTools. The flaw has been actively exploited in the wild by UNC6240 (ShinyHunters) between 2026-05-27 and 2026-06-09, prior to Oracle publishing the public advisory. # Exploit Complexity This is **not** a trivial attack. Full exploitation requires a multi-stage chain: 1. **SSRF trigger** → internal host reachability assessment 2. **Internal footprinting** → identify deployment topology, middleware, cloud metadata 3. **Webshell deployment** → JSP upload through EMHub write interfaces 4. **Post-exploitation** → recon, lateral movement, persistence, cleanup The kit automates every stage, with graceful degradation when individual stages fail. #oracle #peoplesoft #0days #exploit #security #hacking #CVE #CVSS @securityaffairs @lorenzofb @TechCrunch

New from our our team at GTIG: #UNC6240 is back to targeting educational institutions in a new data theft extortion campaign. The activity targets Oracle's #PeopleSoft by exploiting Zero-Day CVE-2026-35273. Disable EMHub and check our blog for guidance. https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit

🚨Cyber Alert ‼️ 🇺🇸🇨🇦🇲🇽🇧🇷 - 𝗡𝗶𝘀𝘀𝗮𝗻 𝗔𝗺𝗲𝗿𝗶𝗰𝗮𝘀 Nissan Americas disclosed a data breach after hackers exploited the Oracle PeopleSoft zero-day (CVE-2026-35273), potentially exposing current and former employees' personal, financial, tax, and national identification data across the U.S., Canada, Mexico, and Brazil. Threat actor: Not Specified (campaign linked to ShinyHunters) Sector: Manufacturing Data exposure (claimed): Not specified Data type: Employee data Observed: Jun 29, 2026 Status: Confirmed ESIX©: 5.78 Full details and impact assessment on http://HackRisk.io

Unit 42 is tracking the active targeting of Oracle PeopleSoft servers by Bling Libra (aka #ShinyHunters). Our analysis reveals suspected exploitation of RCE flaw CVE-2026-35273 and primary targeting of the education sector since at least late May 2026. https://bit.ly/4xpxKLb https://t.co/EijtGPBCs2

🛡️ We added Oracle PeopleSoft Enterprise PeopleTools missing authentication for critical function vulnerability CVE-2026-35273 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/c7j4ZeLYBg

⚠️⚠️ CVE-2026-35273 (CVSS 9.8): Oracle PeopleSoft unauthenticated RCE via PSEMHUB Java deserialization 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJPcmFjbGUtUGVvcGxlU29mdCI= 🎯1.3K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Oracle-PeopleSoft" 🔖Refer: https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html #OSINT #FOFA #CyberSecurity #Vulnerability

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit CVE-2026-35273 https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit https://t.co/1FAzASI7vy

AIを使う側が、狙われる番に回った。 開発を支えるAIツールと暗号・監視の土台が同じ日に穴を突かれ、足元の国内では教育と子どもの情報が漏れた。 ・OpenSSLにCVE-2026-45447、解放後使用の高危険度脆弱性をClaudeが発見 ・AIコーディング支援を騙すAgentjacking、Sentry偽エラーで任意コード実行 ・Langflow CVE-2026-5027、Path Traversalで任意ファイル書き込みを悪用 ・Splunk Enterprise CVE-2026-20253、CVSS 9.8の未認証RCE ・Oracle PeopleSoft CVE-2026-35273、CISAがKEV追加で悪用確認 ・The Gentlemenランサム、AI支援RaaSで478被害を主張 ・学習塾CKCネットワーク・学参がランサム被害、個人情報漏えいの恐れ ・日本大学文理学部サイトが改ざん、カジノサイトへ誘導 ・写真販売「はいチーズ！フォト」不正アクセス、子どもの情報漏えいの可能性 守る道具まで乗っ取られる時代だ。君の現場で今日最初に当てるパッチは決まったか？ "後でいい"は、攻撃者への贈り物だ。