Oracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws
ZERO-DAYCVE-2026-35273redteam/daily · 1 source
- Severity
- Critical
- Exploited
- Yes
- Sources
- 1
What happened
A serious weakness in Oracle's PeopleSoft business software, used by a criminal group called ShinyHunters since May, turns out to be three separate flaws linked together. Oracle fixed all three in June. The problem starts with a trick that makes the server send requests to its own internal controls, which it trusts by default.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- CVE-2026-35273 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
- Check whether you use Oracle PeopleSoft Enterprise PeopleTools: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
The Hacker News