Oracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws
ZERO-DAYCVE-2026-35273redteam/daily · 1 source
- Severity
- Critical
- Exploited
- Yes
- Sources
- 1
What happened
CVE-2026-35273 covers three chained flaws in Oracle PeopleSoft that ShinyHunters has exploited since May; Oracle patched all three in June. The root is an SSRF that reaches an internal management interface because PeopleSoft trusts its loopback address. The excerpt does not name the other two flaws or the affected versions, so defenders should confirm the June Oracle patch is applied and consult the full advisory for details.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- CVE-2026-35273 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
- Check whether you use Oracle PeopleSoft Enterprise PeopleTools: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
The Hacker News