Skip to content
ThreatCluster

Oracle PeopleSoft Zero-Day Exploited via Chained Vulnerabilities

First seen 29 Oct 2026, 03:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 04:08 UTC
  • •CVE-2026-35273 consists of three linked vulnerabilities.
  • •The flaw allows unauthenticated remote code execution in Oracle PeopleSoft.
  • •Oracle patched the vulnerabilities on June 10, 2026, amid active exploitation.

Researchers revealed that the Oracle PeopleSoft zero-day exploited by ShinyHunters was a chain of three vulnerabilities, identified as CVE-2026-35273. This flaw allowed unauthenticated remote code execution, enabling attackers to potentially take over servers. Oracle released a patch for this vulnerability on June 10, 2026, and it was added to the CISA KEV catalog the following day due to. The vulnerabilities allowed external requests to access PeopleSoft’s internal management interface. The ongoing investigation into the attack continues as Oracle E-Business Suite also faces scrutiny for a critical flaw patched recently.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-10
Oracle patches CVE-2026-35273
Oracle released a patch for a chain of vulnerabilities in PeopleSoft that allowed remote code execution.
Feeds.4Sysops
2026-06-12
CVE-2026-35273 added to CISA KEV
CISA added the patched vulnerabilities to its Known Exploited Vulnerabilities catalog due to confirmed exploitation.
Feeds.4Sysops
Recent
Exploratory probes on Oracle EBS
Oracle E-Business Suite is experiencing probes for a critical flaw patched in the October update.
Feeds.4Sysops

More articles in this cluster (2)

Following this threat?

Track shinyhunters, Oracle and CVE-2026-35273 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

What are the specific vulnerabilities in CVE-2026-35273?
CVE-2026-35273 involves a chain of three linked vulnerabilities that allow unauthenticated remote code execution.
Is there evidence of ongoing exploitation?
Yes, the vulnerabilities have been confirmed as actively exploited, leading to their addition to the CISA KEV catalog.
What action should organizations take?
Organizations should apply the patch released by Oracle on June 10, 2026, to mitigate the risk of exploitation.