Oracle pushed an emergency patch on June 10, 2026, for a PeopleSoft flaw that attackers had already been exploiting for two weeks. The bug, tracked as CVE-2026-35273, scored a 9.8 out of 10 on the CVSS severity scale, a rating Rapid7 confirmed the same day, and let anyone with network access to a PeopleSoft server run code on it without a username or password. Google’s Mandiant unit, whose UNC6240 attribution Help Net Security corroborated on June 11, says the extortion crew ShinyHunters used the flaw between May 27 and June 9 to break into more than 100 organizations, a tally TechCrunch also reported on June 11. Sixty-eight percent of the victims were colleges and universities.
By June 12, the Cybersecurity and Infrastructure Security Agency had added the flaw to its Known Exploited Vulnerabilities catalog, and the University of Nottingham had confirmed a breach that exposed roughly 455,000 email addresses along with student and alumni records. The Oracle PeopleSoft zero-day marks a shift for ShinyHunters, a group better known for phishing calls and stolen login tokens than for weaponizing a zero-day in enterprise resource planning software.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Timeline: How the Oracle PeopleSoft Zero-Day Unfolded
Mandiant’s Google Threat Intelligence Group says the exploitation window ran from May 27 to June 11, 2026, after Oracle had no public advisory and no patch available for the relevant flaw. That makes CVE-2026-35273 a genuine zero-day: attackers were using it before defenders even knew it existed. A follow-up report from Security Boulevard on July 13, 2026 put the scale even higher, finding that ShinyHunters had targeted as many as 300 PeopleSoft instances during that same May 27-June 9 window, a broader instance-level count than the 100-plus organizations Mandiant initially confirmed.
Oracle broke that silence on June 10 with an out-of-band Security Alert, an emergency release the company issues outside its normal quarterly patch cycle when a flaw is too urgent to wait. Google published its attribution and technical breakdown the next day, June 11, tying the campaign to the threat cluster it calls UNC6240. CISA added the CVE to its Known Exploited Vulnerabilities catalog on June 12, a listing that triggers mandatory patching deadlines for U.S. federal agencies running the software.
The compressed timeline is unusual even by 2026 standards. Microsoft’s June Patch Tuesday shipped fixes for a record 206 flaws and three separate zero-days just days earlier, and security teams were still working through that backlog when the PeopleSoft advisory landed. For IT departments at large universities, both events hit in the same week.
Inside CVE-2026-35273: What Makes This Flaw Critical
The vulnerability sits inside PeopleSoft’s Updates Environment Management component, the code behind a feature called the Environment Management Hub, or PSEMHUB. Oracle’s advisory and the National Vulnerability Database both rate it 9.8 out of 10. The flaw was reported by researchers at Trend’s Zero Day Initiative, who credit Trend Research with the original discovery. Oracle’s June 11, 2026 advisory also disclosed a second, related flaw, CVE-2026-35276, affecting the same PeopleTools 8.61 and 8.62 releases, underscoring how much latent risk had built up in that single component.
What pushes the score that high is how little an attacker needs. CVE-2026-35273 requires no authentication and no user interaction. It’s reachable over plain HTTP, so any PeopleSoft deployment that exposes its Environment Management Hub to the internet is a target. Oracle’s June 11, 2026 advisory lists PeopleTools 8.61 and 8.62 as the affected supported releases and warns that older, unsupported versions are probably vulnerable too, since PSEMHUB has existed in the platform for years.
A Scoring Discrepancy: 9.8 vs. 9.3
Not every source agrees on the exact number. The Zero Day Initiative’s own advisory lists a vector that works out to 9.3 rather than Oracle and NVD’s 9.8. Oracle’s rating is the more authoritative figure for customers deciding how urgently to act, but the gap shows how much CVSS scoring still depends on which assumptions a given team plugs into the formula. Either score lands the bug in the same critical tier as 2026’s worst disclosures.
That profile, remote, unauthenticated, and capable of full code execution, matches what made this year’s other headline bugs so dangerous. Adobe’s ColdFusion zero-day hit a perfect 10.0 CVSS score and was under active exploitation within two hours of disclosure. Ruby on Rails’ Active Storage flaw, rated 9.5, needed no login either. CVE-2026-35273 fits the same pattern: old enterprise software, a network-facing component nobody thought to isolate, and a single HTTP request standing between an attacker and root-level access.
How ShinyHunters Broke In and Moved Laterally
The technical details of the campaign became public largely by accident. A researcher using the handle @nahamike01 spotted open directories tied to the attack infrastructure and flagged them publicly. Mandiant investigators then traced five sequential IP addresses running a bare-bones Python SimpleHTTPServer instance on port 8888, a surprisingly careless setup for a group Google has tracked for years.
Those exposed servers revealed the attackers’ own toolkit: a shared bash history file, remote-management agents built on the legitimate MeshCentral platform but disguised as Microsoft Azure binaries, and a lateral-movement script. The fake command-and-control domain, azurenetfiles.net, was registered to resemble Azure NetApp Files at a glance, a typosquat meant to blend into normal enterprise network traffic.
The script itself, named using a [victim]_fanout.sh convention, sprayed a hardcoded list of usernames and passwords against internal hosts pulled straight from each compromised server’s /etc/hosts file. Once inside, it dropped a taunting marker file, README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, into PeopleSoft directories. Stolen data was compressed with zstd, a fast compression format, then exfiltrated over SSH to infrastructure hosting a public mirror of the ShinyHunters leak site. Ars Technica reported on June 12, 2026 that the group made off with gigabytes of data from affected organizations, a volume consistent with the scale of records later confirmed at Nottingham and elsewhere.
The University of Nottingham Breach: What Data Was Exposed
The University of Nottingham is the first confirmed named victim of the campaign. Have I Been Pwned, the breach-notification service run by security researcher Troy Hunt, logged approximately 455,000 unique email addresses in the leaked dataset, covering current students and alumni.
The exposure goes well beyond email addresses. The leaked records reportedly include full names, home addresses, phone numbers, passport numbers, and details on students’ ethnicity and disability status, the kind of sensitive personal data that triggers mandatory breach-notification rules in both the UK and the European Union. Nottingham has confirmed the breach occurred.
ShinyHunters has told reporters its outreach to victims is still in the early stages, according to The Hacker News, which means the current list of confirmed institutions is almost certainly incomplete. Mandiant notified more than 100 organizations whose infrastructure matched known-vulnerable PeopleSoft endpoints, and not every one of them has gone public yet.
The Scope: 100+ Organizations, 68% in Higher Education
The table below lines up the campaign’s scope using the figures Mandiant and Oracle have confirmed so far. The higher-education concentration is the standout number: more than two-thirds of the affected organizations are colleges and universities, institutions that tend to run PeopleSoft for student records, financial aid, and HR functions all at once, which makes a single compromised instance unusually valuable to an extortion crew. Google’s Threat Intelligence Group reaffirmed that higher-education concentration in a September 26, 2026 update, noting the sector remained the campaign’s primary target months after the initial disclosure.
| Metric | Figure / Detail |
|---|---|
| Vulnerability | CVE-2026-35273 (CVSS 9.8, Critical) |
| Affected component | PeopleTools Environment Management Hub (PSEMHUB) |
| Affected versions | PeopleTools 8.61, 8.62 (earlier unsupported builds likely vulnerable) |
| Exploitation window | May 27 – June 9, 2026 (zero-day) |
| Oracle advisory published | June 10, 2026 |
| Threat actor | ShinyHunters (tracked by Google as UNC6240) |
| Organizations notified | 100+ |
| Share in higher education | 68% |
| Confirmed leaked records (Univ. of Nottingham) | ~455,000 unique email addresses |
| CISA KEV catalog addition | June 12, 2026 |
That concentration isn’t a coincidence. Universities often keep legacy administrative software running for a decade or more between major upgrades, and the Environment Management Hub is the kind of internal tooling that IT staff configure once and rarely revisit. That’s exactly the profile of forgotten, internet-facing infrastructure that zero-day hunters look for.
Oracle’s Patch and Mitigation Guidance
Oracle’s fix requires action beyond simply installing an update. For PeopleSoft deployments running on multiple servers, the company recommends disabling the Environment Management Hub service entirely. Single-server installations should remove the PSEMHUB application outright if it isn’t actively needed.
Where neither option is practical, Oracle and Mandiant both point to a narrower fallback: block external access to /PSEMHUB/* (particularly the /PSEMHUB/hub path) and /PSIGW/HttpListeningConnector at the network perimeter. Mandiant’s advisory warns that relying on web application firewall body-inspection rules alone isn’t enough, since those rules can be bypassed, and notes that blocking the endpoints outright doesn’t interfere with normal user logins or sessions.
Security vendors moved fast to back that guidance. BleepingComputer reported on June 11, 2026 that Oracle had issued its emergency mitigation guidance ahead of a full patch, and both eSentire and Arctic Wolf published their own advisories within days, urging customers to check exposure immediately rather than wait for a scheduled maintenance window. Customers should then apply Oracle’s PeopleTools update through My Oracle Support once it’s confirmed available for their specific version, alongside the perimeter blocks in the meantime.
Hunting for Compromise: What Security Teams Should Check
Because the exploitation window ran three weeks before Oracle’s advisory, patching alone doesn’t rule out an existing compromise. Rapid7’s and Mandiant’s technical write-ups list specific signs that a PeopleSoft server was already hit.
Indicators of Compromise
WebLogic access logs: external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector
Unexpected .jsp files under the PSEMHUB.war directory, or new folders named logs, persistantstorage, or scratchpad
Recently modified .xml files under envmetadata/data/environment (possible XMLDecoder persistence that fires on next restart)
Outbound SMB traffic on port 445 from PeopleSoft hosts to external destinations (possible NetNTLM hash capture)
Unfamiliar remote-management agents on PeopleSoft hosts, including tools disguised as Microsoft Azure binariesAny of these findings warrants isolating the host and starting incident response rather than assuming the perimeter blocks alone solved the problem. Given the campaign’s use of MeshCentral agents disguised as Azure tooling, security teams should treat any unfamiliar remote-management software on PeopleSoft hosts as suspicious by default.
Who Is ShinyHunters? Inside a Year of Escalating Attacks
ShinyHunters isn’t new. Google tracks the group’s current activity as UNC6240, and some researchers now use the label “Scattered Lapsus$ Hunters” to describe a loose ecosystem that overlaps in tactics and personnel with Scattered Spider and Lapsus$, rather than one formal organization. What’s changed is the group’s range.
Between August 2025 and June 2026, ShinyHunters-linked actors ran a string of OAuth-token supply-chain attacks: a Salesloft/Drift compromise that touched more than 700 organizations, a Gainsight incident that reached over 200 Salesforce instances, and a breach at Klue affecting tokens tied to 195 organizations. In late April 2026, the group hit Instructure’s Canvas learning platform, exposing roughly 3.65 terabytes of data, some 275 million records, across 8,809 educational institutions. In March 2026, The Register reported that ShinyHunters claimed to have stolen data from about 100 high-profile companies, including Salesforce itself. The group also claimed the Eastman Kodak breach disclosed earlier this year.
The FBI’s Internet Crime Complaint Center issued a public warning on May 15, 2026, specifically flagging ShinyHunters’ attacks on learning-management-system/education organizations, before the PeopleSoft campaign became public. No arrests of ShinyHunters principals have been confirmed as of this writing.
From Social Engineering to Zero-Days: Why This Attack Marks a Shift
Nearly every ShinyHunters campaign before this one leaned on human weaknesses rather than software bugs: vishing calls to IT help desks, stolen OAuth tokens, and abused vendor access. The Canvas breach, the Salesloft/Drift incident, and the Gainsight compromise all followed that playbook, tricking someone into handing over legitimate credentials rather than breaking in through code.
CVE-2026-35273 is different. It’s a server-side, pre-authentication remote code execution bug, the kind of vulnerability researchers usually associate with dedicated exploit-development work, not social-engineering crews. Whether ShinyHunters bought or borrowed the exploit from another actor, or built the capability in-house, is a question Mandiant’s public reporting hasn’t answered yet.
That question matters for defenders. Vishing requires a live human on the other end of the phone, which limits how fast a campaign can scale. A network-reachable zero-day scales to every exposed server on the internet at once, which is a large part of why Mandiant’s victim count crossed 100 organizations in under three weeks.
How CVE-2026-35273 Stacks Up Against 2026’s Other Critical Flaws
2026 has been a heavy year for critical, pre-authentication flaws in enterprise software. The table below lines up the PeopleSoft bug against four other headline vulnerabilities disclosed this year.
| Vulnerability | Vendor / Product | CVSS | Key Detail |
|---|---|---|---|
| CVE-2026-35273 | Oracle PeopleSoft | 9.8 | Exploited as a zero-day; 100+ orgs notified, mostly universities |
| ColdFusion zero-day | Adobe | 10.0 | Exploited within 2 hours of disclosure |
| Active Storage flaw | Ruby on Rails | 9.5 | No authentication required |
| Weak RNG flaw | CryptoJS (npm) | 9.0 | $5.7M in crypto wallets drained |
| “4th Bleed” flaw | Citrix NetScaler | Critical | Exploited within 24 hours of disclosure |
The pattern across all five is similar: trusted enterprise software with a network-facing component that was never designed for today’s exploitation speed. Citrix’s NetScaler flaw was under active exploitation within 24 hours of disclosure. Adobe’s ColdFusion bug fell within two hours. The gap between disclosure and mass exploitation keeps shrinking, which is exactly why Oracle skipped its normal quarterly cycle and shipped an emergency fix instead of waiting.
Market Impact: Enterprise Software Patching Under Pressure
The PeopleSoft incident lands inside a broader shift in how attackers reach victims. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities overtook stolen credentials as an initial attack vector, present in 31% of the breaches it analyzed, the first time exploits have led that ranking in the report’s history. CVE-2026-35273 is a clean example of why: one unpatched HTTP endpoint replaced the phishing emails, phone calls, and password sprays that used to be a criminal group’s opening move.
For Oracle, the incident adds pressure on an already crowded 2026 patch calendar and raises questions about how long PeopleSoft, a platform Oracle has run since acquiring it in 2005, keeps receiving this level of ad hoc emergency support. For customers, the calculus is blunter: universities and public-sector agencies running PeopleSoft now have to weigh the cost of migrating off aging ERP infrastructure against the risk of the next zero-day landing on a system they can’t easily replace.
Cyber-insurance underwriters are watching the same signal. A pattern of repeated, large-scale education-sector breaches, Canvas in April and PeopleSoft in June, tends to sharpen scrutiny of an institution’s patch management and network segmentation at renewal time, even without a public statement from any specific insurer. It’s the latest entry in a fast-growing list of 2026 cybersecurity threats aimed squarely at enterprise software vendors.
Higher Education’s Growing Cybersecurity Exposure Problem
Universities make an unusually attractive target for a specific reason: they run enormous, decentralized IT environments while protecting some of the most sensitive personal data outside of healthcare. Financial aid records, health information, disciplinary files, and now, thanks to incidents like this one, passport numbers and disability status all sit inside the same administrative systems.
Budget is the recurring constraint. Higher-education IT departments typically support tens of thousands of user accounts with security teams a fraction of the size of a comparable-revenue private company, and legacy systems like PeopleSoft often predate the staff currently responsible for maintaining them. Old software, thin staffing, and rich data is precisely the combination that put universities at the center of two major 2026 breaches within about six weeks of each other.
Neither Canvas nor PeopleSoft is optional software a university can simply switch off. Both sit at the core of how a modern institution operates, which is exactly why ShinyHunters keeps returning to the sector.
What Happens Next: 5 Predictions
Based on the pattern established by ShinyHunters’ prior campaigns and the current state of Oracle’s response, here’s what’s likely over the coming months:
- More named victims emerge. With ShinyHunters saying outreach has only begun and Mandiant having notified 100+ organizations, expect additional universities and public-sector agencies to confirm breaches through July and August 2026.
- CISA’s KEV listing forces federal deadlines. Now that CVE-2026-35273 sits in the Known Exploited Vulnerabilities catalog, federal civilian agencies running PeopleSoft face binding remediation deadlines, likely pulling other public-sector users toward faster patching by association.
- Oracle faces scrutiny over PeopleSoft’s roadmap. Expect renewed customer pressure on Oracle to commit to longer-term PeopleSoft security investment or offer a clearer migration path to cloud-based alternatives.
- ShinyHunters keeps blending tactics. Having proven it can pair its usual data-extortion playbook with a working exploit chain, the group likely keeps mixing OAuth-token abuse with opportunistic zero-day use rather than settling on one method.
- Higher-education cyber-insurance terms tighten. Following Canvas and PeopleSoft, expect insurers to push harder on patch-timeline and network-segmentation requirements specifically for education-sector renewals in late 2026.
Frequently Asked Questions
What is CVE-2026-35273?
It’s a critical, unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools, specifically in the Environment Management Hub (PSEMHUB) component. It carries a CVSS score of 9.8 out of 10 and requires no login or user interaction to exploit over HTTP.
Who is exploiting the Oracle PeopleSoft zero-day?
Google’s Mandiant unit attributes the campaign to ShinyHunters, a threat cluster it tracks as UNC6240. The group used the flaw between May 27 and June 11, 2026, before Oracle’s June 10 patch.
Which PeopleSoft versions are affected?
Oracle lists PeopleTools 8.61 and 8.62 as affected supported releases. The company also warns that earlier, unsupported versions likely contain the same flaw, since the vulnerable component has existed in the platform for years.
How many organizations were hit?
Mandiant notified more than 100 organizations whose infrastructure matched known-vulnerable PeopleSoft endpoints. About 68% of them are colleges and universities, mostly in the United States.
What data was exposed in the University of Nottingham breach?
Have I Been Pwned recorded roughly 455,000 unique email addresses in the leaked dataset, alongside names, home addresses, phone numbers, passport numbers, and details on students’ ethnicity and disability status.
How can IT teams check for compromise?
Look for external POST requests in WebLogic logs to /PSEMHUB/hub or /PSIGW/HttpListeningConnector, unexpected .jsp files under the PSEMHUB.war directory, recently modified XML files under envmetadata/data/environment, and unusual outbound SMB traffic on port 445.
Has Oracle released a permanent fix?
Oracle issued an out-of-band Security Alert and emergency mitigation guidance on June 10, 2026. Customers should apply the PeopleTools update through My Oracle Support once it’s confirmed available for their version, alongside the perimeter blocking Oracle recommends in the meantime.
Is ShinyHunters connected to Scattered Spider?
Researchers see overlapping tactics, social-engineering methods, and even branding between ShinyHunters, Scattered Spider, and Lapsus$, sometimes grouped under the label “Scattered Lapsus$ Hunters.” That describes a loosely connected ecosystem rather than one single, formally merged group.
