Skip to content
SSRF to RCE Vulnerability in Oracle PeopleSoft Exploited by ShinyHunters

SSRF to RCE Vulnerability in Oracle PeopleSoft Exploited by ShinyHunters

First seen 28 Oct 2026, 02:21 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 04:19 UTC
  • •CVE-2026-35273 has a CVSS score of 9.8, indicating critical severity.
  • •ShinyHunters group is actively exploiting this vulnerability in the wild.
  • •Oracle has issued a patch, but many systems remain vulnerable.

On September 25, 2026, Mandiant reported ongoing mass exploitation of CVE-2026-35273 by the ShinyHunters group, a vulnerability in Oracle PeopleSoft. The vulnerability, first reported by TrendAI's Zero Day Initiative on June 10, 2026, allows attackers to leverage a Server-Side Request Forgery (SSRF) to achieve remote code execution (RCE). The SSRF vulnerability affects the PeopleSoft Integration Gateway (PSIGW) and the PeopleSoft Environment Management Hub (PSEMHUB), enabling attackers to bypass security controls. Oracle has issued a patch for the vulnerability, but exploitation continues, indicating that many systems remain. The CVE has a CVSS score of 9.8, categorizing it as. The ongoing exploitation poses a significant risk to organizations using affected PeopleSoft components.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-10
CVE-2026-35273 reported to Oracle
TrendAI's Zero Day Initiative reported the SSRF vulnerability affecting multiple PeopleSoft components.
Zerodayinitiative
2026-06-11
CVE-2026-35273 published
The vulnerability was officially published with a CVSS score of 9.8, indicating critical severity.
Zerodayinitiative
2026-06-12
CVE added to CISA KEV
CISA added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog due to active exploitation.
Zerodayinitiative
2026-09-25
Mass exploitation reported
Mandiant reported ongoing mass exploitation of CVE-2026-35273 by the ShinyHunters group.
Zerodayinitiative

More articles in this cluster (2)

Following this threat?

Track shinyhunters, Oracle and CVE-2026-35273 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4

Common questions

What systems are affected by CVE-2026-35273?
The vulnerability affects multiple components of Oracle PeopleSoft, specifically the PeopleSoft Integration Gateway and Environment Management Hub.
Is there a patch available for this vulnerability?
Yes, Oracle has issued a patch for CVE-2026-35273, but many systems may still be unpatched.
How urgent is the situation regarding this vulnerability?
The vulnerability is actively exploited in the wild, making it critical for organizations to apply patches immediately.