ZDI breaks down Oracle PeopleSoft CVE-2026-35273 exploit chain leading to RCE
A technical analysis by ZDI describes three flaws that it says are part of CVE-2026-35273 in Oracle PeopleSoft. Oracle released a fix in June, while the vulnerability had already been actively exploited.
PeopleSoft CVE-2026-35273 does not involve one isolated flaw, according to a new technical analysis by the Zero Day Initiative (ZDI), but rather a chain of three separately reported vulnerabilities across multiple PeopleSoft components. Their combination may allow an unauthenticated remote attacker to execute code on the affected system.
Oracle released fixes and mitigations for the flaw on June 10, 2026. The risk affects internet-accessible, unpatched deployments of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Mandiant and the Google Threat Intelligence Group (GTIG) had previously documented active exploitation of the vulnerability.
How PeopleSoft CVE-2026-35273 works
The chain described by ZDI begins with a server-side request forgery (SSRF) vulnerability in the Integration Gateway component. SSRF allows an application to send a request to an internal target that would normally not be accessible from outside.
In this case, an attacker can use the loopback address to reach the internal PSEMHUB component. According to ZDI, additional flaws then lead to remote code execution. The attacker does not need credentials.
In its security alert, Oracle confirmed that CVE-2026-35273 can be exploited remotely without authentication and that its impact is RCE. ZDI also states that Oracle fixed three separately reported vulnerabilities under a single CVE identifier.
Why WAF rules alone were not enough
Mandiant and GTIG attributed exploitation of CVE-2026-35273 to the UNC6240 group, also known as ShinyHunters. In September, they observed renewed mass attacks against Oracle PeopleSoft.
Researchers warned that the attackers were able to bypass WAF rules based only on text-based path matching. They used percent-encoded, or URL-encoded, variants of the path. ZDI’s technical explanation also highlights a broader perimeter-security issue: SSRF can abuse an application’s trust in its own local interface.
Mandiant therefore does not consider blocking selected paths in a WAF a substitute for applying Oracle’s fix. Administrators should first verify that the June patch is deployed on all relevant PeopleTools 8.61 and 8.62 instances, especially those accessible from the internet.
What administrators should check
In addition to patching, the available findings recommend checking for possible signs of compromise. Relevant indicators include external POST requests directed at PSEMHUB, including its percent-encoded variants, and unknown JSP files in the PSEMHUB.war directory.
- Verify deployment of Oracle’s fix for CVE-2026-35273.
- Identify internet-accessible PeopleSoft PeopleTools 8.61 and 8.62 systems.
- Check logs for POST requests to PSEMHUB and URL-encoded forms of the relevant path.
- Inspect the PSEMHUB.war directory for unknown JSP files.
Oracle has not yet publicly disclosed separate CVE identifiers for each of the three flaws described by ZDI. ZDI says it is coordinating the assignment of separate identifiers with the vendor. It is also not independently confirmed that every historically attributed intrusion by the ShinyHunters group used all three flaws in exactly the same chain.
Sources
- Zero Day Initiative – As the vulnerability reporter, ZDI describes three reported vulnerabilities, SSRF, and paths to RCE; it also mentions coordination of separate CVEs with Oracle.
- Oracle Security Alert Advisory – Oracle confirms the affected versions, unauthenticated remote exploitation, the RCE impact, a severity of 9.8, and the availability of fixes and mitigations since June 10, 2026.
- Google Cloud Blog / Mandiant and GTIG – Mandiant and GTIG document renewed mass exploitation of CVE-2026-35273 by the UNC6240/ShinyHunters group, WAF bypasses, and recommended defensive steps.
- NIST National Vulnerability Database – NVD lists the product versions, CVSS 9.8, and the vulnerability’s classification among known actively exploited vulnerabilities.
Verified and updated: October 28, 2026, 15:24
