Oracle PeopleSoft Zero-Day Actively Exploited by ShinyHunters

"A Single Weakness Can Change Everything"

Cybersecurity is an asymmetric battle. Attackers need to find only one weakness, while defenders must secure every possible entry point. The latest campaign attributed to the ShinyHunters threat group demonstrates this reality with alarming clarity. A newly disclosed zero-day vulnerability in Oracle PeopleSoft, CVE-2026-35273 (CVSS 9.8 Critical), is being actively exploited in the wild. Security researchers have observed threat actors leveraging the flaw to gain unauthorized access to vulnerable systems, potentially leading to data theft, system compromise, and large-scale organizational disruption.

Understanding the Threat

The ShinyHunters cybercriminal group has reportedly weaponized this vulnerability to conduct Remote Code Execution (RCE) attacks against internet-facing Oracle PeopleSoft environments.

What Makes This Vulnerability So Dangerous?

• No authentication required

• Exploitable directly over the internet

• Critical severity (CVSS 9.8)

• Allows remote code execution

• Targets enterprise systems containing highly sensitive data

• Active exploitation already observed

Unlike many vulnerabilities that require user interaction or valid credentials, this flaw can be exploited remotely, significantly reducing the effort required by attackers and increasing the likelihood of successful compromise.

Who Is at Risk?

Organizations running exposed Oracle PeopleSoft environments are particularly vulnerable.

Affected Platforms

• Oracle PeopleSoft Applications

• PeopleTools 8.61

• PeopleTools 8.62

• Internet-accessible PeopleSoft deployments

High-Value Targeted Modules

Attackers are specifically interested in systems storing:

• Human Resources (HR) data

• Finance and Accounting records

• Payroll information

• Student Information Systems (SIS)

• Employee and customer personally identifiable information (PII)

These applications often serve as the operational backbone of large enterprises, universities, government institutions, and multinational organizations.

Impact Observed So Far

Security reports indicate that more than 100 organizations have already been affected, with threat actors actively scanning for and exploiting vulnerable systems.

Potential consequences include:

• Unauthorized access to sensitive enterprise data

• Large-scale data exfiltration

• Credential theft

• Deployment of ransomware

• Financial fraud

• Operational disruption

• Regulatory and compliance violations

For many organizations, a compromise of PeopleSoft can expose years of sensitive business and employee information.

The Cybersecurity Reality: One Vulnerability Is Enough

This incident serves as a powerful reminder of a fundamental cybersecurity challenge:

Attackers only need one vulnerability. Defenders must secure them all.

A single unpatched internet-facing application can provide adversaries with the foothold they need to move laterally across networks, escalate privileges, and compromise critical business assets. The PeopleSoft zero-day demonstrates how quickly an overlooked vulnerability can evolve into a major enterprise security incident.

Immediate Actions Recommended by GTIS

Organizations should take urgent action to reduce exposure and mitigate risk.

1. Patch Immediately

Upgrade Oracle PeopleSoft environments to PeopleTools 8.63 or apply vendor-recommended security updates as soon as possible.

2. Restrict Internet Exposure

• Remove unnecessary public access

• Implement network segmentation

• Restrict access through VPNs and trusted IP ranges

• Place critical applications behind secure access controls

3. Review Historical Activity

Conduct a thorough review of:

• Authentication logs

• Application logs

• Web server logs

• Administrative actions

Pay particular attention to suspicious activity observed between June 3 and June 8, 2026, when exploitation activity significantly increased.

4. Hunt for Indicators of Compromise

Investigate for:

• Unusual administrative accounts

• Unexpected process execution

• Suspicious outbound connections

• Unauthorized file modifications

• Privilege escalation attempts

5. Activate Incident Response Procedures

If compromise is suspected:

• Isolate affected systems immediately

• Preserve forensic evidence

• Engage internal SOC and Incident Response teams

• Conduct a full compromise assessment

• Notify stakeholders and regulatory bodies where required

GTIS Threat Intelligence Insights

GTIS Threat Intelligence has observed heightened activity targeting enterprise applications worldwide. The exploitation of CVE-2026-35273 highlights a growing trend in which threat actors prioritize business-critical platforms that provide direct access to sensitive organizational data.

This incident reinforces the importance of:

• Continuous vulnerability management

• Real-time threat intelligence monitoring

• Security posture assessments

• Exposure management programs

• Security Operations Center (SOC) monitoring

• Incident response preparedness

Organizations that combine proactive vulnerability management with continuous monitoring are significantly better positioned to detect and contain emerging threats before they escalate.

Conclusion

The active exploitation of CVE-2026-35273 by ShinyHunters is a stark reminder that cyber threats move faster than traditional security processes. Critical enterprise applications such as Oracle PeopleSoft remain attractive targets because they contain some of an organization's most valuable data.

The message for security teams is clear:

Patch. Monitor. Assess. Respond.

In today's threat landscape, vigilance is not optional—it is a business necessity. Organizations must assume that threat actors are actively searching for weaknesses and take immediate action to reduce exposure before a vulnerability becomes a breach.

GTIS continues to monitor this threat and provide actionable intelligence to help organizations strengthen their defenses against emerging cyber risks.