VULNpocalypse
CriticalVulnerabilityPatch available

Oracle PeopleSoft PeopleTools CVE-2026-35273: ShinyHunters zero-day used for data theft at universities

A pre-auth flaw in PeopleTools 8.61 and 8.62 was used by ShinyHunters to steal data, mostly from universities. Apply Oracle’s fix and block /PSEMHUB/.

Published
Updated
Fixed in
Oracle patch and mitigations referenced in My Oracle Support document CPU187 (PeopleTools 8.61 and 8.62)
Exploitation
Yes. Mandiant saw zero-day exploitation by UNC6240 (ShinyHunters) from 27 May to 9 June 2026; in CISA KEV since 12 June 2026

Live scores

CVE-2026-35273
EPSS
0.967
very likely to be attacked soon
VEDAS
0.988
strong exploit evidence
On CISA KEV
Yes, since 2026-06-12
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
100.1CVE-2026-35273 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-35273 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

On 10 June 2026, Oracle issued a Security Alert for CVE-2026-35273 in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. It affects versions 8.61 and 8.62, needs no authentication, and is rated CVSS 9.8. A successful attack “can result in takeover of PeopleSoft Enterprise PeopleTools” (CVE record). TrendAI classes it as server-side request forgery; Mandiant describes it as remote code execution with the SSRF as the route in (Rapid7).

It was a zero-day. Mandiant saw exploitation from 27 May to 9 June 2026 and attributes it to UNC6240, also known as ShinyHunters. Stolen data was posted to the ShinyHunters leak site on 9 June (Rapid7). Mandiant notified more than 100 organizations whose systems looked vulnerable; most were in the US and 68% were in higher education. ShinyHunters confirmed the attacks to BleepingComputer and claimed data from 300 instances at more than 100 organizations, which has not been independently verified (BleepingComputer).

The attackers targeted /PSEMHUB/hub and /PSIGW/HttpListeningConnector. After getting in, they installed MeshCentral remote management agents disguised as Azure services, mapped PeopleSoft and WebLogic configuration, moved laterally with stolen or hardcoded credentials, and sent zstd-compressed data out (Rapid7; BleepingComputer).

CISA added the CVE to KEV on 12 June with a due date of 15 June, and marks it as known to be used in ransomware campaigns (CISA KEV).

Am I affected?

You are affected if any PeopleSoft environment runs PeopleTools 8.61 or 8.62 without Oracle’s fix (CVE record). The PeopleTools release is shown in the PeopleSoft application under the “About This Page” link. Your exposure is highest if /PSEMHUB/ or /PSIGW/HttpListeningConnector answer from the internet. Test from outside your network.

Indicators from Mandiant, via Rapid7 (Rapid7):

  • Web logs: external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector, and requests to HttpListeningConnector that contain loopback or internal addresses.
  • Files: unexpected .jsp files under the PSEMHUB.war path; unauthorized files under envmetadata/transactions/; unexpected logs, persistantstorage or scratchpad directories; recently modified .xml files under envmetadata/data/environment/; a file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.
  • Network: traffic to 142.11.200.186 through 142.11.200.190, the domain azurenetfiles.net, or 176.120.22.24 (exfiltration and leak site). Also outbound SMB (TCP 445) from PeopleSoft servers, which the exploit chain may cause.
  • MeshCentral agents (SHA-256): meshagent64-azure-ops.exe f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc; meshagent64-v2.exe d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f; meshagent32-azure-ops.exe c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f; Linux meshagent 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309.
bash
# On the PeopleSoft web server (adjust PS_CFG_HOME and log paths)
grep -rlE 'PSEMHUB|HttpListeningConnector' $PS_CFG_HOME/webserv/*/servers/*/logs/ 2>/dev/null
find $PS_CFG_HOME/webserv -path '*PSEMHUB*' -name '*.jsp' -newermt '2026-05-27' 2>/dev/null
find / -name 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' 2>/dev/null

What to do now

  1. Apply Oracle’s fix from My Oracle Support document CPU187 on an emergency basis. The support document needs an Oracle login, and Oracle’s alert page refused our request. BleepingComputer reported that Oracle first shipped mitigations with a patch “coming soon” (BleepingComputer; Rapid7).
  2. Turn off the Environment Management Hub. Disable the service in multi-server setups, or remove the PSEMHUB application in single-server setups (Rapid7).
  3. Block /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter. Mandiant considers this safe for normal PIA browser sessions (Rapid7).
  4. Block outbound SMB from PeopleSoft servers to untrusted destinations. The chain may leak Windows machine-account NetNTLM hashes over TCP 445 (Rapid7).
  5. Hunt back to 27 May 2026 using the indicators above. If you find any, assume data theft. Rotate the PeopleSoft, WebLogic and database credentials the attackers could have read, since they moved laterally with stolen or hardcoded credentials (BleepingComputer), and remove any MeshCentral agents.

Sources