ShinyHunters' Exploitation of Oracle PeopleSoft CVE-2026-35273: A Wake-Up Call for Higher Education
Executive Summary
In late May 2026, the cybercriminal group ShinyHunters exploited a zero-day vulnerability, CVE-2026-35273, in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. This flaw allowed unauthenticated remote code execution, leading to the compromise of over 100 organizations, predominantly in the U.S. higher education sector. The University of Nottingham confirmed significant student data theft following the group's data leak. Oracle disclosed the vulnerability on June 10, 2026, and released a critical patch, urging immediate application to mitigate further risks.
This incident underscores the critical importance of timely patch management and proactive vulnerability monitoring. The exploitation of unpatched systems by threat actors like ShinyHunters highlights the need for organizations to enhance their cybersecurity posture to prevent similar breaches.
Why This Matters Now
The ShinyHunters' exploitation of CVE-2026-35273 in Oracle PeopleSoft PeopleTools has led to significant data breaches, particularly in the higher education sector. This incident emphasizes the urgent need for organizations to promptly apply security patches and strengthen their defenses against rapidly evolving cyber threats.
Attack Path Analysis
Attackers exploited an unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools (CVE-2026-35273) to gain initial access. They likely escalated privileges to obtain administrative control over the compromised servers. Subsequently, they moved laterally within the network to access additional systems and data. The attackers established command and control channels to maintain persistent access. They exfiltrated sensitive data from the compromised systems. Finally, they engaged in extortion by threatening to release the stolen data unless a ransom was paid.
Kill Chain Progression
Initial Compromise
Description
Exploitation of CVE-2026-35273 in Oracle PeopleSoft PeopleTools allowed unauthenticated remote code execution, granting attackers initial access.
Related CVEs
CVE-2026-35273
CVSS 9.8An easily exploitable vulnerability in Oracle PeopleSoft Enterprise PeopleTools allows unauthenticated attackers with network access via HTTP to fully compromise the system, leading to potential remote code execution.
Affected Products:
Oracle PeopleSoft Enterprise PeopleTools – 8.61, 8.62
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: PowerShell
Valid Accounts
OS Credential Dumping
Exfiltration Over C2 Channel
Data Encrypted for Impact
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.05
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Higher Education/Acadamia
Oracle PeopleSoft zero-day exploitation targeting 68% higher education institutions enables data theft extortion affecting student records and HR systems.
Information Technology/IT
Unpatched Oracle PeopleSoft vulnerability allows remote code execution requiring immediate egress security controls and threat detection capabilities implementation.
Government Administration
PeopleSoft HR and CRM systems vulnerability exposes sensitive government data to ShinyHunters extortion campaigns through unencrypted traffic exploitation.
Health Care / Life Sciences
Oracle PeopleSoft compromise threatens HIPAA compliance through data exfiltration requiring zero trust segmentation and encrypted traffic controls.
Sources
- ShinyHunters is actively extorting universities after exploiting an unpatched Oracle flawhttps://cyberscoop.com/oracle-peoplesoft-zero-day-vulnerability-shinyhunters-extortion/Verified
- Oracle Security Alert Advisory - CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlVerified
- NVD - CVE-2026-35273https://nvd.nist.gov/vuln/detail/CVE-2026-35273Verified
- Cybercriminals claim breach of Oracle PeopleSoft servers at 100-plus organizations | TechCrunchhttps://techcrunch.com/2026/06/10/cybercriminals-claim-breach-of-oracle-peoplesoft-servers-at-100-plus-organizations/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust Cloud Native Security Fabric (CNSF) is pertinent to this incident as it could have significantly limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial exploitation may still occur, CNSF would likely limit the attacker's ability to leverage the compromised workload to access other systems.
Control: Zero Trust Segmentation
Mitigation: Even with elevated privileges, attackers would likely find their access constrained to the initially compromised workload, limiting their ability to control other systems.
Control: East-West Traffic Security
Mitigation: CNSF would likely restrict unauthorized lateral movement, making it difficult for attackers to access additional systems beyond the initial compromise.
Control: Multicloud Visibility & Control
Mitigation: CNSF would likely detect and limit unauthorized command and control communications, reducing the attacker's ability to maintain persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: CNSF would likely limit unauthorized data exfiltration by enforcing strict egress policies, reducing the risk of sensitive data being transmitted to external servers.
With CNSF's controls in place, the scope of data accessible to attackers would likely be limited, reducing the potential impact of extortion attempts.
Impact at a Glance
Affected Business Functions
- Student Information Systems
- Human Resources Management
- Financial Administration
Estimated downtime: 14 days
Estimated loss: $5,000,000
Personal identifiable information (PII) of students and staff, including names, addresses, social security numbers, and financial records.
Recommended Actions
Key Takeaways & Next Steps
- • Apply the latest security patches for Oracle PeopleSoft PeopleTools to mitigate CVE-2026-35273.
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Enhance East-West Traffic Security to monitor and control internal network communications.
- • Deploy Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to suspicious activities promptly.
