Pre-Advisory Carnage: ShinyHunters' PeopleSoft Zero-Day Campaign Breaches 100+ Organizations
Executive Summary
Security researchers have exposed a highly coordinated, mass-exploitation zero-day campaign conducted by the notorious ShinyHunters extortion syndicate. Between May 27 and June 9, 2026, the group (tracked by Mandiant as UNC6240) systematically exploited a critical, unauthenticated remote code execution (RCE) vulnerability in Oracle PeopleSoft. The campaign successfully breached more than 100 enterprise environments across 300 independent instances before Oracle published its official security advisory on June 10. The first confirmed victim, the University of Nottingham, had over 455,000 student records published online, signaling a brutal shift toward the industrialization of Enterprise Resource Planning (ERP) exploitation.
Technical Breakdown of CVE-2026-35273
The vulnerability, tracked as CVE-2026-35273 (CVSS score 9.8), lies within the Environment Management component of Oracle PeopleSoft's core management software suite, PeopleTools (affecting versions 8.61 and 8.62).
The flaw is classified as an unauthenticated, remote command injection vulnerability that requires zero user interaction and has extremely low execution complexity:
The Exploit Pipeline
1. Endpoint Exposure: The PeopleSoft Environment Management Hub utilizes a public-facing HTTP endpoint to coordinate communication between client environments and the core administrative server.
2. Missing Access Control: The endpoint fails to enforce logical authentication or cryptographic signature verification on incoming XML or JSON payloads.
3. Command Injection: By sending a single, malformed HTTP POST request containing embedded OS commands to the vulnerable Environment Management Hub endpoint, an attacker can bypass all authorization layers.
4. Server Takeover: The command is processed directly by the local system interpreter under the execution privileges of the web application server process (often running as SYSTEM on Windows or root/oracle on Linux), granting the attackers full server control, shell access, and direct database read/write permissions.
Vulnerability Metric
Details
CVE Identifier
CVE-2026-35273
CVSS Score
9.8 (Critical)
Target Software
Oracle PeopleSoft PeopleTools (8.61 & 8.62)
Vulnerability Class
Unauthenticated Command Injection (CWE-78)
Primary Victim Sector
Higher Education and Enterprise Administration
Industry Impact and the Zero-Day Window
The ShinyHunters PeopleSoft campaign highlights a critical, structural vulnerability in enterprise software security. ERP systems like PeopleSoft serve as the central nervous system for major organizations, storing sensitive financial ledgers, corporate HR documents, Social Security numbers, and personal identity records.
Because UNC6240 conducted its mass-exploitation campaign prior to public disclosure, enterprise defenders were completely blind to the intrusion. There were no signatures, no CVEs, and no indicators of compromise (IoCs) to flag. Sixty-eight percent of the target pool consisted of universities. At the University of Nottingham, ShinyHunters exfiltrated and leaked names, physical addresses, phone numbers, passport numbers, and sensitive demographic data (including ethnicity and physical disabilities) of current and former students.
Recommendations and Mitigations
Organizations operating Oracle PeopleSoft environments must take immediate, emergency steps to secure their ERP systems:
1. Deploy Emergency Oracle Patches: Immediately apply the patches released by Oracle on June 10 for PeopleTools versions 8.61 and 8.62. If updating is delayed, disable the Environment Management Hub component entirely.
2. Strictly Restrict Edge Access: Never expose PeopleSoft Environment Management or administrative portal endpoints directly to the public internet. Ensure all such portals are nested behind secure, authenticated corporate Virtual Private Networks (VPNs) or Zero-Trust Network Access (ZTNA) gateways.
3. Implement Strict Network Segmentation: Cryptographically segment your PeopleSoft database and application servers from the rest of the corporate network, blocking unauthorized lateral communication from compromised endpoints.
4. Deploy Application-Aware WAF Rules: Configure your Web Application Firewall (WAF) to inspect all HTTP POST requests targeting /OA_HTML/ or Environment Management endpoints, automatically dropping payloads containing command strings or unvetted scripts.