Executive Summary
Between May 27 and June 9, 2026, the cybercriminal group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. This critical flaw allowed unauthenticated remote code execution, leading to unauthorized access and data exfiltration from over 100 organizations, predominantly universities. The University of Nottingham confirmed a breach affecting approximately 500,000 current and former students' personal and academic records. Oracle released a security advisory on June 10, 2026, acknowledging the vulnerability and urging immediate mitigation measures.
This incident underscores the escalating threat posed by sophisticated cybercriminal groups targeting enterprise software vulnerabilities, particularly in the education sector. The exploitation of zero-day vulnerabilities for large-scale data breaches highlights the urgent need for organizations to implement proactive security measures, including timely patch management and comprehensive monitoring of critical systems.
Why This Matters Now
The ShinyHunters' exploitation of CVE-2026-35273 in Oracle PeopleSoft PeopleTools has led to significant data breaches across numerous organizations, emphasizing the critical need for immediate patching and enhanced security protocols to protect sensitive information.
Attack Path Analysis
ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools, allowing unauthenticated remote code execution. After initial access, they escalated privileges within the PeopleSoft environment to gain administrative control. The attackers moved laterally to access sensitive data across interconnected systems. They established command and control channels to exfiltrate data without detection. Sensitive information, including student records, was exfiltrated to external servers. The attackers demanded ransom payments to prevent public disclosure of the stolen data.
Kill Chain Progression
Initial Compromise
Description
Exploited CVE-2026-35273 in Oracle PeopleSoft PeopleTools, allowing unauthenticated remote code execution.
Related CVEs
CVE-2026-35273
CVSS 9.8A vulnerability in Oracle PeopleSoft Enterprise PeopleTools allows unauthenticated remote attackers to execute arbitrary code via HTTP, potentially leading to full system compromise.
Affected Products:
Oracle PeopleSoft Enterprise PeopleTools – 8.61, 8.62
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Command and Scripting Interpreter
Application Layer Protocol
Exfiltration Over Web Service
Data Encrypted for Impact
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Controls and Identity Management
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Higher Education/Acadamia
Universities face critical exposure to Oracle PeopleSoft zero-day exploits enabling ransomware attacks, student data theft, and compliance violations across HIPAA and NIST frameworks.
Financial Services
PeopleSoft systems in financial institutions vulnerable to ShinyHunters extortion campaigns, threatening sensitive financial data and triggering PCI DSS compliance breach requirements.
Health Care / Life Sciences
Healthcare organizations using PeopleSoft face ransomware exposure with patient data exfiltration risks, creating HIPAA violations and disrupting critical medical service delivery.
Government Administration
Government entities running Oracle PeopleSoft systems exposed to zero-day exploits enabling lateral movement, data exfiltration, and potential national security implications.
Sources
- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universitieshttps://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.htmlVerified
- NVD - CVE-2026-35273https://nvd.nist.gov/vuln/detail/CVE-2026-35273Verified
- Oracle Security Alert Advisory - CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF could have limited the attacker's ability to move laterally and exfiltrate data, thereby reducing the overall impact of the incident.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's initial access may have been constrained, potentially limiting their ability to execute unauthorized code.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may have been limited, reducing their control over the environment.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement could have been restricted, limiting access to interconnected systems and sensitive data.
Control: Multicloud Visibility & Control
Mitigation: The attacker's command and control channels may have been detected and disrupted, limiting their ability to exfiltrate data.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts may have been constrained, reducing the volume of sensitive information transferred to external servers.
The attacker's ability to leverage stolen data for ransom may have been reduced, limiting the potential for financial and reputational damage.
Impact at a Glance
Affected Business Functions
- Student Information Systems
- Financial Aid Processing
- Enrollment Management
Estimated downtime: 14 days
Estimated loss: $500,000
Personal identifiable information (PII) of students and staff, including Social Security numbers, academic records, and financial data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement inline intrusion prevention systems (IPS) to detect and block exploitation attempts of known vulnerabilities like CVE-2026-35273.
- • Enforce zero trust segmentation to limit lateral movement within the network.
- • Deploy egress security and policy enforcement to monitor and control outbound data transfers.
- • Utilize multicloud visibility and control solutions to detect and respond to anomalous activities across cloud environments.
- • Regularly update and patch systems to mitigate known vulnerabilities promptly.
