ShinyHunters Exploited Chain of 3 Flaws in Oracle PeopleSoft
Attackers used a chain of three vulnerabilities to exploit Oracle PeopleSoft. The flaws were patched as CVE-2026-35273 in June.
TL;DR
- ShinyHunters exploited a zero-day in Oracle PeopleSoft since May 2026.
- The vulnerability was actually three separate flaws chained together.
- At the core was an SSRF leading to access of an internal management interface.
- Oracle addressed all three issues under a single patch: CVE-2026-35273.
- Organizations should ensure they’ve applied June’s PeopleSoft updates.
In a recent discovery, the threat group ShinyHunters leveraged not one but three distinct vulnerabilities within Oracle PeopleSoft to carry out their attacks. These flaws, which allowed attackers to perform server-side request forgery (SSRF), were chained together to bypass protections and access internal systems.
Although initially treated as a single zero-day vulnerability, researchers later confirmed that CVE-2026-35273 actually covered a sequence of weaknesses. The most critical component involved an SSRF flaw that took advantage of PeopleSoft's trust in its own loopback address, exposing an internal management interface to remote exploitation.
Vulnerability Breakdown
- The primary issue was a server-side request forgery (SSRF) that targeted internal services.
- PeopleSoft incorrectly trusted requests originating from its local loopback address, enabling deeper system access.
- Two additional supporting flaws helped escalate privileges and maintain persistent access during the attack chain.
- All three components were patched collectively by Oracle in June 2026 under CVE-2026-35273.
Impact and Mitigation
- Organizations using Oracle PeopleSoft should verify that June 2026 patches are fully deployed.
- Unpatched instances remain vulnerable to similar SSRF-based attacks targeting internal interfaces.
- Security teams should audit web applications for improper trust relationships with localhost services.
- Monitoring for unusual outbound SSRF-like traffic can help detect active exploitation attempts.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.