Three Flaws, One Patch, One Zero-Day: How ShinyHunters Dismantled Oracle PeopleSoft Security
Executive Summary
Between May 27 and June 9, 2026, the financially motivated threat group ShinyHunters (tracked by Mandiant as UNC6240) exploited a zero-day chain in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, later patched as CVE-2026-35273 (CVSS 9.8). The attack chains three distinct flaws: an unauthenticated server-side request forgery (SSRF) in the Integration Gateway (PSIGW), a loopback-trust bypass in the Environment Management Hub (PSEMHUB), and either an arbitrary file-write for web shell deployment or a malicious XMLDecoder payload for stealthier code execution. Oracle issued an out-of-band patch on June 10; a second, broader campaign targeting universities, healthcare, government, and technology sectors was confirmed by Mandiant in September 2026.
The September wave demonstrated that WAF-based mitigations were bypassed trivially via URL-encoding, underscoring a persistent industry pattern: perimeter controls are insufficient when attackers can manipulate request encoding, and organizations relying on signature-based filtering rather than patching remain exposed. ShinyHunters' data-theft-then-extortion model means affected organizations face both data breach notification obligations and ransom demands simultaneously.
Why This Matters Now
CVE-2026-35273 is actively listed on CISA's Known Exploited Vulnerabilities catalog, and ShinyHunters has already launched a second mass-exploitation wave across six industries. With Oracle PeopleSoft widely deployed in higher education, healthcare, and government, and with attackers demonstrating WAF-bypass via URL-encoding, organizations that have not yet patched or disabled PSEMHUB remain at imminent risk of data theft and extortion with limited detection opportunity.
Attack Path Analysis
ShinyHunters (UNC6240) exploited a chained zero-day in Oracle PeopleSoft (CVE-2026-35273) beginning May 27, 2026, using an unauthenticated SSRF in the Integration Gateway (PSIGW) to reach the internally trusted Environment Management Hub (PSEMHUB) via loopback address, escalating to remote code execution by writing web shells or malicious XMLDecoder payloads as the PeopleSoft service account. From there, attackers moved laterally across the PeopleSoft application tier, maintained persistent command-and-control through planted web shells, exfiltrated sensitive institutional and enterprise data, and ultimately leveraged stolen data for extortion campaigns targeting universities, healthcare, technology, and government sectors across a second, larger wave in September.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
ShinyHunters sent unauthenticated HTTP requests to the PeopleSoft Integration Gateway (PSIGW) listening connector, exploiting a server-side request forgery (SSRF) vulnerability that performed no destination validation. By controlling both the forwarding address and the full request payload, attackers directed PSIGW to issue requests to the internal PSEMHUB interface at 127.0.0.1, which passed the allowedhosts.properties trust check because the loopback address was whitelisted by default. WAF bypass was achieved by URL-encoding a single character in the /PSEMHUB/ path (/%50SEMHUB/), defeating path-based WAF rules that matched only plain-text patterns.
Related CVEs
CVE-2026-35273
CVSS 9.8A chained vulnerability in Oracle PeopleSoft Enterprise PeopleTools involving a server-side request forgery (SSRF) in the Integration Gateway (PSIGW) that can be pivoted through the default loopback trust configuration of the Environment Management Hub (PSEMHUB) to achieve unauthenticated remote code execution via web shell deployment or malicious XMLDecoder deserialization.
Affected Products:
Oracle PeopleSoft Enterprise PeopleTools – 8.61, 8.62
Exploit Status:
exploited in the wildReferences:
https://nvd.nist.gov/vuln/detail/CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlhttps://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesofthttps://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploithttps://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesofthttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Server Software Component: Web Shell
Command and Scripting Interpreter: JavaScript
Application Layer Protocol: Web Protocols
Impair Defenses: Impair Command History Logging
Obfuscated Files or Information
Exfiltration Over C2 Channel
Financial Theft
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
PCI DSS 4.0 – All System Components Are Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Access Privileges and Management
Control ID: 500.7
DORA (EU) 2022/2554 – ICT Risk Management and Vulnerability Handling
Control ID: Article 9 – ICT Security Policies
NIS2 Directive (EU) 2022/2555 – Supply Chain and System Acquisition Security
Control ID: Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Internal Traffic Validation
Control ID: Network Pillar – Macro/Micro Segmentation
HIPAA Security Rule – Protection from Malicious Software
Control ID: 45 CFR § 164.308(a)(5)(ii)(B)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Higher Education/Acadamia
ShinyHunters' initial zero-day wave specifically targeted universities via Oracle PeopleSoft CVE-2026-35273, enabling unauthenticated RCE, data theft, and extortion against student and faculty records systems.
Health Care / Life Sciences
Confirmed in ShinyHunters' September renewal wave; PeopleSoft SSRF-to-RCE exposes PHI under HIPAA.164.312(e)(1) and HIPAA.164.308(a)(3), with lateral movement and exfiltration risks rated critically high.
Government Administration
Government entities hit in the expanded exploitation campaign face NIST.800-53.SC-7 and ZTMM.Network compliance failures as chained SSRF flaws bypass perimeter controls, enabling privileged data exfiltration and extortion.
Information Technology/IT
IT services organizations running Oracle PeopleSoft face RCE via PSIGW SSRF chaining, with WAF bypass through URL-encoding exposing egress exfiltration gaps mapped to NIST.CSF.PR.DS-5 and PCI.4.0.3.5.1.
Sources
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flawshttps://thehackernews.com/2026/10/shinyhunters-exploited-oracle.htmlVerified
- Oracle Security Alert for CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlVerified
- ZDI Analysis: CVE-2026-35273 SSRF to RCE in Oracle PeopleSofthttps://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoftVerified
- ShinyHunters Targets Education Sector via Oracle PeopleSoft Exploithttps://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploitVerified
- ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSofthttps://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoftVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD Entry for CVE-2026-35273https://nvd.nist.gov/vuln/detail/CVE-2026-35273Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attack chain depended on unrestricted internal reachability between PSIGW, PSEMHUB, backend data stores, and external egress paths. A Zero Trust segmentation fabric would likely have constrained attacker reach at multiple stages, reducing the blast radius from a single exploited gateway to a much smaller, isolated application boundary.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: A Zero Trust fabric enforcing workload-aware perimeter policies could likely reduce the reachability of internal interfaces like PSEMHUB from public-facing application endpoints, making the SSRF pivot path harder to complete even when the application-layer vulnerability exists.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation enforcing identity-scoped access between the integration gateway and application management components could likely constrain the trust relationship that allowed PSEMHUB to accept and act on attacker-controlled payloads, reducing the scope of privilege available to a compromised request.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies at the workload level could likely reduce the number of backend systems reachable from a compromised PeopleSoft host, constraining lateral pivot paths to only those explicitly permitted between defined workload identities rather than allowing broad application-tier connectivity by default.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the application environment could likely surface anomalous inbound command patterns or unexpected interactive sessions to the PeopleSoft tier, helping operations teams identify persistent web shell activity that might otherwise blend into normal application traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement restricting outbound connections from PeopleSoft workloads to explicitly approved external destinations could likely constrain the attacker's ability to transfer data to unauthorized infrastructure, reducing the volume or completeness of exfiltration even when the compromised host is already under attacker control.
Had earlier segmentation and egress controls been in place, the scope of data reachable from a single compromised PeopleSoft instance would likely have been narrower, reducing the volume of sensitive records available for weaponization and potentially limiting attacker leverage to a smaller subset of affected organizations.
Impact at a Glance
Affected Business Functions
- Student Information Systems and Academic Record Management (Higher Education)
- Enterprise Resource Planning (ERP) and HR/Payroll Services
- Healthcare Patient Administration and Billing Systems
- Government Citizen Services and Administrative Portals
Estimated downtime: 14 days
Estimated loss: N/A
The exploitation of CVE-2026-35273 by ShinyHunters (UNC6240) across two distinct campaign waves resulted in unauthorized access to PeopleSoft-hosted data spanning multiple sectors. Confirmed and probable exposed data categories include: personally identifiable information (PII) of students and faculty from targeted universities; employee records including HR, payroll, and benefits data from technology, IT services, and government entities; patient administrative and billing records from healthcare organizations; and enterprise authentication credentials reachable from the compromised PeopleSoft service account tier. The threat actor's established pattern of data theft followed by extortion demands indicates that exfiltrated data was likely leveraged for ransom negotiations. Web shells planted during exploitation may have enabled persistent access and secondary credential harvesting across dozens of affected systems worldwide. Financial loss figures are not publicly confirmed but extortion payments and incident response costs for dozens of affected organizations are expected to be substantial.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce identity-based microsegmentation around PeopleSoft application tiers, preventing the compromised PSIGW service from freely reaching PSEMHUB or any backend system without explicit policy authorization — loopback-based trust chains should never substitute for verified network policy.
- • Deploy Egress Security & Policy Enforcement (ZTMM.Data, NIST.CSF.PR.DS-5) with FQDN filtering and outbound traffic controls on all PeopleSoft application hosts to block data exfiltration to unauthorized external destinations, terminating ShinyHunters' data-theft pipeline before bulk transfer completes.
- • Enable East-West Traffic Security (ZTMM.Network, NIST.800-53.SC-7) to inspect and restrict workload-to-workload flows from PeopleSoft application servers to databases, internal APIs, and directory services, containing lateral movement radius after initial web shell deployment.
- • Activate Multicloud Visibility & Control (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) with centralized traffic observability to baseline normal PeopleSoft Integration Gateway behavior and alert on anomalous loopback-forwarded requests, repeated malformed path patterns (e.g., URL-encoded /%50SEMHUB/ variants), and unexpected outbound connection spikes indicative of active exploitation or exfiltration.
- • Deploy Inline IPS with Suricata signatures (NIST.800-53.SI-4, PCI.4.0.6.4.1) covering SSRF exploit patterns, known CVE-2026-35273 request signatures, and web shell traffic indicators on PeopleSoft-facing network segments, providing a defense-in-depth layer that complements but does not replace patching, and use Encrypted Traffic protection (NIST.CSF.PR.DS-2) to ensure exfiltration channels cannot evade inspection through unencrypted transit paths.
