A critical remote code execution vulnerability in Oracle PeopleSoft was silently exploited for nearly two weeks before Oracle issued a patch — and the attackers behind the campaign were ShinyHunters, one of the most prolific data extortion groups operating today. The breach swept across more than 100 organizations, with universities bearing the brunt of the damage.
A Zero-Day Hidden in Plain Sight
The flaw, tracked as CVE-2026-35273, lives in PeopleSoft Enterprise PeopleTools — specifically in the Updates Environment Management component that powers the Environment Management Hub (PSEMHUB). With a CVSS severity score of 9.8 out of 10, it sits near the top of the risk scale for good reason: an attacker needs nothing more than HTTP access to the server to execute arbitrary code remotely. No login. No user interaction. No phishing required.
Oracle credits researchers from TrendAI Zero Day Initiative and TrendAI Research for reporting the bug and lists PeopleTools versions 8.61 and 8.62 as confirmed affected, while noting earlier, unsupported versions are likely vulnerable as well. The company published its out-of-band advisory on June 10, 2026 — but by that point, ShinyHunters had already been exploiting it for nearly a fortnight.
ShinyHunters’ Campaign: Fourteen Days of Silent Exploitation
Google’s Mandiant threat intelligence team, tracking the attackers under the designation UNC6240, pinpoints the campaign’s active window as May 27 through June 9, 2026. That timeline means every compromise during those two weeks was conducted against organizations that had no patch available and no advisory to warn them.
Mandiant CTO Charles Carmakal confirmed publicly that the vulnerability was being exploited in the wild. The operational details of exactly how ShinyHunters found or acquired the zero-day have not been disclosed, but what they did with it is now well-documented — because they left their own infrastructure exposed.
Researcher @nahamike01 spotted open directory listings on five sequential IP addresses running Python’s built-in SimpleHTTP server on port 8888. Those exposed directories contained the group’s staging files: a shared shell history, custom MeshCentral remote management agents disguised as Microsoft Azure binaries, and a lateral movement script named [victim]_fanout.sh.
The MeshCentral agents phoned home to a command-and-control server at azurenetfiles.net — a domain carefully named to evoke legitimacy by mimicking Azure NetApp Files. The fanout script spread across victim networks by spraying hardcoded username and password combinations against internal hosts pulled from /etc/hosts over SSH. Once established on a system, it dropped a distinctive marker: a file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT planted inside PeopleSoft directories.
The shell history captured on the exposed staging server showed attackers compressing stolen data with the zstd archiver and establishing outbound SSH tunnels to the server hosting ShinyHunters’ public leak site — closing the loop on the extortion chain.
Universities in the Crosshairs
Mandiant notified more than 100 organizations whose IP addresses were identified as exposed and potentially compromised. The breakdown tells a clear story about target selection: 68 percent of victims were in higher education, with a heavy concentration in the United States.
PeopleSoft is deeply embedded in university administration. Schools rely on it for student information systems, financial aid records, HR management, and payroll. The combination of rich personal data and aging, complex on-premises deployments made universities a high-value target.
The University of Nottingham is among the first confirmed victims to go public. According to breach notification data collected by Have I Been Pwned, approximately 455,000 unique email addresses appear in the leaked dataset — covering current students, former students, and alumni. The exposed records include names, postal addresses, phone numbers, passport numbers, and sensitive demographic details including ethnicity and disability information. The university has confirmed the breach occurred.
ShinyHunters has stated that victim outreach and data publication is ongoing, suggesting the number of confirmed public victims will grow.
CISA Raises the Alarm; Federal Agencies Face a Deadline
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-35273 to its Known Exploited Vulnerabilities (KEV) catalog on June 12, 2026 — two days after Oracle’s advisory. The KEV designation carries legal weight for U.S. federal agencies: under Binding Operational Directive 22-01, civilian federal agencies are required to remediate catalogued vulnerabilities within defined windows. For this flaw, the deadline is July 3, 2026.
The implied message to the private sector is equally clear: this vulnerability is being actively weaponized, and it has already been used to breach more than a hundred organizations.
What Administrators Need to Do Right Now
Oracle’s interim guidance, while a patch is confirmed available in My Oracle Support, centers on three mitigation actions:
Disable or remove the Environment Management Hub. On multi-server PeopleSoft deployments, disabling the PSEMHUB service eliminates the attack surface. On single-server setups, Oracle recommends removing the PSEMHUB application entirely.
Block the vulnerable endpoints at the perimeter. If neither of the above is immediately possible, organizations should block external access to /PSEMHUB/* (particularly /PSEMHUB/hub) and /PSIGW/HttpListeningConnector. Mandiant notes that WAF body-inspection rules alone are insufficient because they can be bypassed — network-level blocking of these paths is the appropriate control.
Hunt for signs of existing compromise. Administrators should examine WebLogic access logs for external POST requests to the vulnerable endpoints, look for unexpected .jsp files under the PSEMHUB.war web application directory, check for unusual folders named logs, persistantstorage, or scratchpad under PSEMHUB paths, review recently modified .xml files under the envmetadata/data/environment path (which can be abused for XMLDecoder persistence that survives restarts), and monitor for outbound SMB traffic on port 445 from PeopleSoft hosts — a technique the exploit chain may use to capture machine-account credential hashes.
Blocking the vulnerable endpoints does not disrupt normal user sessions.
A Strategic Shift for ShinyHunters
ShinyHunters has long been associated with credential theft, vishing, and weak access control exploits against SaaS platforms and cloud services. Earlier activity linked to the group — or to UNC6040, an overlapping Mandiant designation — targeted Salesforce customers and canvas-based learning management systems.
Exploiting a server-side zero-day in on-premises enterprise ERP software represents a tactical escalation. The attack surface for PeopleSoft is narrower than consumer SaaS, but the organizations running it tend to hold dense, high-value datasets: student records, payroll, benefits, immigration documentation. The return per victim is substantial, and the barriers to exploitation — once the zero-day was in hand — were minimal.
Whether CVE-2026-35273 represents a one-off opportunity or signals ShinyHunters’ move into ERP-focused exploitation as a durable strategy remains an open question. But for organizations running PeopleSoft, the immediate answer is the same: restrict those endpoints, hunt for indicators of compromise, and apply Oracle’s patch as soon as it is confirmed available for your PeopleTools version.
*Sources: The Hacker News, Mandiant / Google Cloud Threat Intelligence, SecurityWeek, The Register, Help Net Security, CISA KEV Catalog*
