Oracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws
ZERO-DAYCVE-2026-35273redteam/daily · 1 source
- Severity
- Critical
- Exploited
- Yes
- Sources
- 1
What happened
Researchers report that the critical PeopleSoft bug exploited by ShinyHunters since May is three chained flaws rather than one. Oracle patched them in June under a single identifier, CVE-2026-35273. The chain begins with a server-side request forgery that reaches an internal management interface because PeopleSoft trusts its own loopback address.
For IT people · Written by AI from 1 source · Wrong?
What to do
- CVE-2026-35273 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
- Check whether you use Oracle PeopleSoft Enterprise PeopleTools: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
The Hacker News