ShinyHunters’ Oracle PeopleSoft zero

Feeds.4Sysops •IT News • October 28, 2026

Researchers have disclosed that the Oracle PeopleSoft zero-day exploited by ShinyHunters was a chain of three vulnerabilities, not a single flaw. Oracle patched the chain as CVE-2026-35273 on June 10, but the attack had already enabled unauthenticated remote code execution. The findings show how a request from outside the network could reach PeopleSoft’s internal management interface and lead to server takeover. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle PeopleSoft Zero-Day Exploited via Chained Vulnerabilities Researchers revealed that the Oracle PeopleSoft zero-day exploited by ShinyHunters was a chain of three vulnerabilities, identified as CVE-2026-35273. This flaw allowed unauthenticated remote code execution, enabling attackers to potentially take over servers. Oracle released a patch for this vulnerability on June 10, 2026, and it was added to the CISA KEV catalog the following day due to. The vulnerabilities allowed external requests to access PeopleSoft’s internal management interface. The ongoing investigation into the attack continues as Oracle E-Business Suite also faces scrutiny for a critical flaw patched recently. 2 sources 70

Extracted Entities

ShinyHunters’ Oracle PeopleSoft zero

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

CVEs (1)

Platforms (1)