ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

Researchers at Trend Micro's Zero Day Initiative have revealed that the Oracle PeopleSoft flaw ShinyHunters abused since May was actually three separate bugs rolled into one advisory, CVE-2026-35273. The root cause is a server-side request forgery in the PeopleSoft Integration Gateway (PSIGW) that lets an attacker reach the internal Environment Management Hub (PSEMHUB) by spoofing the trusted loopback address 127.0.0.1, which is whitelisted by default. From there, attackers can either plant a web shell via a log-writing function or trigger unsafe XML deserialization on service restart to achieve remote code execution, all without authentication. Oracle patched PeopleTools 8.61 and 8.62 in a June out-of-band alert (CVSS 9.8), but Mandiant/GTIG found the group UNC6240 (ShinyHunters) exploiting it as a true zero-day against universities between May 27 and June 9, later expanding in September to tech, healthcare, agriculture, transport and government targets, in some cases bypassing WAF rules via URL encoding. ZDI is still working with Oracle to split the flaw into separate CVE identifiers, and defenders are urged to patch immediately, disable or remove the Environment Management Hub if patching isn't possible, and rotate credentials and hunt for web shells on any potentially affected system.