ShinyHunters 針對 Oracle PeopleSoft 零日漏洞實際為三個連鎖缺陷

Swati KhandelwalOct 28, 2026Vulnerability / Enterprise Security

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution without a login.

The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle.

In its analysis, ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each. As of this week, the one June identifier is still the only one on the record.

CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over the server over the network. Oracle released its fix in an out-of-band security alert on June 10. The flaw is on CISA's Known Exploited Vulnerabilities catalog.

Attackers were already using it before that fix was in place. Mandiant and Google Threat Intelligence Group (GTIG) attribute a campaign to the group it tracks as UNC6240, better known as ShinyHunters, that exploited the flaw between May 27 and June 9, mostly against universities. Because that activity came before Oracle's June 10 advisory, it was a zero-day the whole time.

In a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.

ZDI's analysis explains what that single patch actually closed. Two PeopleSoft components are involved, both run as separate web applications. The Integration Gateway (PSIGW) exchanges messages with outside systems. The Environment Management Hub (PSEMHUB) is an internal admin interface that is supposed to answer only to trusted hosts.

The first flaw is the SSRF in PSIGW. An attacker sends a request to its listening connector and controls both the address it forwards to and the full payload it sends, ZDI said; the handler does no check that the destination is a legitimate target. That alone would be limited, except for what it can reach.

PSEMHUB decides who to trust by checking the requester against a list in a file named allowedhosts.properties. That file ships with the local loopback address, 127.0.0.1, already on the list. So an attacker points the SSRF at 127.0.0.1, the request arrives looking like it came from the machine itself, and the trust check passes. The internal interface Oracle meant to wall off is now reachable from outside.

From there, ZDI described two ways to turn that access into code execution. One abuses a PSEMHUB command meant to write log entries: the caller controls both the file contents and the exact path on disk, so an attacker writes a web shell into the application directory and runs commands as the PeopleSoft service account.

The other writes a malicious XML file that PSEMHUB reads using Java's XMLDecoder when the service next starts, thereby running the attacker's code without planting a web shell at all. The second path leaves less for standard detection to catch.

The design decision at the center, ZDI said, is that allowing loopback access by default makes the trust check ineffective once the SSRF exists. That matters for defenders who thought a firewall rule had covered them.

In the September wave, Mandiant found ShinyHunters slipping past web application firewall (WAF) rules that blocked the /PSEMHUB/ path by url-encoding a single character, requesting /%50SEMHUB/ instead. Many WAF rules match the path's plain text, while the PeopleSoft server decodes it and serves the page.

What to Do

The fix and the guidance here come from Oracle and Mandiant, not from ZDI's analysis, which covers the flaw rather than the response.

• Apply the patch. Install Oracle's security alert fix for CVE-2026-35273 and stay on a supported PeopleTools release. Mandiant is explicit that path-based WAF blocking is not a substitute for patching.
• If you cannot patch yet, disable the Environment Management Hub service in multi-server setups, or remove the PSEMHUB application in single-server setups, as Oracle's alert advises. Restricting these admin endpoints does not break normal user sessions.
• If you may already be hit, Mandiant recommends treating any host with a web shell as compromised, preserving evidence, and rotating every credential reachable from the PeopleSoft tier. ShinyHunters steals data and then demands payment, so affected organizations should prepare for extortion.

One thing the sources do not settle is whether applying the patch removes access an attacker already gained. Oracle's alert does not address it, and Mandiant's guidance to rotate credentials and hunt for web shells assumes it does not. Patching closes the door; it does not by itself evict someone already inside.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.