Oracle PeopleSoft PeopleTools Remote Code Execution Vulnerability (CVE-2026-35273)

Oracle's Security Alert says CVE-2026-35273 is "remotely exploitable without authentication" and "may result in remote code execution." The CVE record adds that an unauthenticated attacker with network access over HTTP can take over PeopleSoft Enterprise PeopleTools. Its CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N, needs no login and no user action.

The flaw sits in the Environment Management Hub, PSEMHUB, which PeopleSoft uses to manage updates. CISA files it under CWE-306, missing authentication for a critical function.

One CVE, Three Bugs

TrendAI's Zero Day Initiative (ZDI) reported the issue to Oracle on 10 June 2026. On 27 October, ZDI researcher Bobby Gould wrote that Oracle patched "three distinct vulnerabilities" under this one CVE. ZDI says it is working with Oracle to assign a separate CVE to each.

• A server-side request forgery (SSRF) in the Integration Gateway's HttpListeningConnector, ZDI-26-387. It needs no login.
• An external control of file path flaw in PSEMHUB, ZDI-26-389. The caller picks both the file content and the path, so a web shell can land in the web folder.
• A deserialization flaw in PSEMHUB, ZDI-26-388. A planted XML file runs code the next time the hub servlet starts.

PSEMHUB only answers trusted hosts, and its default allow list includes localhost. ZDI says the SSRF sends requests from the server's own loopback address, so the check passes. Chained, the bugs give code execution as the PeopleSoft service account.

How ShinyHunters Used It

Mandiant and Google Threat Intelligence Group (GTIG) reported on 11 June 2026 that UNC6240, which they call ShinyHunters, exploited the flaw from 27 May to 9 June. That was before Oracle's alert, so it was a zero-day. Google says it warned over 100 organizations, 68 percent of them in higher education.

On 25 September 2026, the same teams reported renewed mass exploitation. The actor requested /%50SEMHUB/ instead of /PSEMHUB/, where %50 is the encoded letter P. Many WAF rules match the literal path before decoding, while WebLogic decodes it and serves the hub anyway.

Google says this wave planted web shells on dozens of systems worldwide. Targets spanned higher education, technology, IT services, healthcare, agriculture, transportation and government. The tools included the x.jsp and u.jsp shells, the Neo-reGeorg tunnel, MeshAgent and a backdoor GTIG tracks as SIDEEYE.

GTIG's September report describes direct requests to the hub servlet that abuse Java deserialization. ZDI's chain starts at the Integration Gateway instead. Both end at PSEMHUB, so we read them as two routes to the same component. GTIG adds that UNC6240 steals data and threatens to publish it unless paid.

What Our Checks Showed

These are the public signals we checked on 31 October 2026.

On X, ZDI called its post "a deep dive into the bug(s) used in the recent PeopleSoft attacks." Open the ZDI post on X (@thezdi, 27 October). Some GitHub repositories claim to be exploits or scanners. We did not run them and do not link them.

In Brandefense Blackhole, 29 of the 68 posts came on 11 and 12 June and 19 from 24 to 29 September. Most repeat news reports. On 15 June, a post on a Turkish-language hacking forum offered a "one-click exploit" behind a like-to-view gate. We have not verified that claim.

Oracle's October 2026 Critical Patch Update does not include this flaw, since the fix came in June. CVE-2025-61882 in E-Business Suite is another Oracle business application flaw that CISA lists with known ransomware use.

Oracle lists PeopleSoft Enterprise PeopleTools 8.61 and 8.62 as the supported versions affected. It adds that PeopleSoft Enterprise Applications customers may also be affected. Older releases are not tested, but Oracle says they are likely affected too.

Oracle publishes the patch details in a patch availability document on My Oracle Support, which needs a support login. We could not read that document, so this page lists no patch numbers. Oracle's alert itself has not changed since its first release on 10 June 2026.

Mandiant, citing Oracle's guidance, gives a second route. Disable the EMHub service in multi-server setups, or remove the PSEMHUB application in single-server setups. Mandiant says cutting EMHub and the Integration Broker listening connector off from the public internet does not break normal user sessions.

Mandiant's June advice also said to block /PSEMHUB/* at the perimeter where patching was not yet possible. The September wave got around string-based versions of that block. Mandiant now says WAF rules and path-based blocking are "not a substitute for patching." Our vulnerability management guide covers how to plan and check a rollout.