ShinyHunters exploited three chained PeopleSoft flaws before Oracle’s June fix

Mandiant and Google Threat Intelligence Group attribute a ShinyHunters campaign tracked as UNC6240 to three chained Oracle PeopleSoft flaws exploited from May 27 to June 9, 2026, mostly against universities, before Oracle patched them June 10, 2026 under CVE-2026-35273.

Researchers disclosed that the zero-day consisted of three distinct vulnerabilities across two PeopleSoft components, all patched under CVE-2026-35273. Bobby Gould of the Zero Day Initiative reported the flaws, and ZDI asked Oracle for a separate CVE for each one. As of October 28, 2026, only CVE-2026-35273 from June appears on the record.{

The chain involves PeopleSoft’s Integration Gateway, known as PSIGW, and the Environment Management Hub, known as PSEMHUB. PSIGW handles message exchange with external systems. PSEMHUB serves as an internal admin interface meant to respond only to trusted hosts.

The first flaw is a server-side request forgery, or SSRF, in PSIGW. An attacker controls the forwarding address and the full payload sent through its listening connector, and the PSIGW handler performs no validation of where the forwarded request is going. PSEMHUB verifies trust by comparing the requester to a list stored in allowedhosts.properties, a list that arrives with the local loopback address, 127.0.0.1, already included. By aiming the SSRF at 127.0.0.1, the attacker makes the request appear to originate from the local machine, so the trust check succeeds.

Oracle intended to wall off this internal interface, but default permission for loopback access nullifies the trust check when an SSRF is present. The interface becomes reachable from outside although Oracle designed it to stay internal.

One abuse path targets a PSEMHUB log-writing command. Because the caller controls both the file contents and the disk path, an attacker can drop a web shell, a script that lets an attacker run commands on a server, in the application directory and run commands as the PeopleSoft service account. A second path writes a malicious XML file that PSEMHUB processes with Java’s XMLDecoder at the next service start, executing attacker code without a web shell. That route leaves less for standard detection to catch.

CVE-2026-35273 covers the /PSIGW/HttpListeningConnector endpoint, letting an unauthenticated attacker direct the application server to contact internal or external addresses the attacker selects. SSRF is among the most critical API security risks because internal systems assume requests arriving from the application server are legitimate. The pivot leads directly to remote code execution and full server takeover, with the ability to read, modify, or exfiltrate any data the PeopleSoft application can access.

Researchers at Pathlock noted that the attackers operated within PeopleSoft’s own application logic rather than through a direct database exploit, making the access look like that of a legitimate user to the application layer. PeopleSoft is one of the most widely used enterprise resource planning suites worldwide, and universities, hospital systems, and government agencies rely on it for financial aid, payroll, student records, human resources, and supply chain tasks.

Oracle issued the fix through an out-of-band security alert dated June 10, 2026. The advisory was an unscheduled update triggered by active exploitation, and Oracle characterized its recommended mitigations as high-priority risk reduction measures, saying to “strongly recommend immediate action.”{

The vulnerability is listed on CISA’s Known Exploited Vulnerabilities catalog. CISA Binding Operational Directive 26-04, issued June 10, 2026, mandates that US federal agencies remediate actively exploited flaws such as CVE-2026-35273 within three calendar days.{

PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected by CVE-2026-35273, which carries a CVSS score of 9.8. An unauthenticated attacker can seize control of the server across the network with no login required. Oracle considers older, unsupported PeopleSoft versions likely vulnerable, though those releases were not tested.{

Mandiant and Google Threat Intelligence Group attribute the May 27 to June 9, 2026 exploitation to UNC6240, better known as ShinyHunters, mostly against universities. Mandiant notified more than 100 organizations whose IP addresses matched potentially vulnerable endpoints, and GTIG described the addresses as “correlated with potentially vulnerable endpoints.” Sixty-eight percent of the organizations Mandiant alerted were academic institutions, including universities and colleges worldwide.{

Some organizations experienced compromise that resulted in ShinyHunters publishing stolen data on the ShinyHunters data leak site on June 9, 2026. Oracle’s June 10 advisory came one day after stolen data from affected organizations first appeared on the leak site.

The University of Nottingham said it experienced a cybersecurity incident, and ShinyHunters released stolen records for about 454,600 current and former students after the university refused to pay the ransom. The exposed records covered personal details, academic information, billing data, and financial aid records.

On June 14, 2026, ShinyHunters said it had stolen 297 GB of data and more than 429,000 files from several Council of Europe departments, citing payroll records, bank account details, social security numbers, and personal information for more than 10,000 employees over 15 years. The Council of Europe said it was investigating the claims and would not comment beyond that; as of publication, neither payment nor a data release had been confirmed. ShinyHunters said it tried to breach an FBI portal running PeopleSoft in order to post a public statement, but the attempt failed.

ShinyHunters claims to have stolen data from approximately 300 individual PeopleSoft instances across more than 100 organizations, and Mandiant has described these claims as consistent with its own observations of exploitation activity. A single compromised PeopleSoft environment may expose student immigration records, financial aid disbursements, payroll details for employees, healthcare information, and administrative credentials.

Mandiant reported in September that a renewed, larger wave moved beyond education into technology, IT services, healthcare, agriculture, transport, and government, hitting dozens of systems around the world. During the September wave, ShinyHunters bypassed web application firewall (WAF) rules targeting the /PSEMHUB/ path by sending /%50SEMHUB/ instead. Many WAF rules look for the plain text path, but the PeopleSoft server decodes the request and serves the page anyway.

Mandiant states that blocking the path with a WAF cannot replace applying the patch. Mandiant also said, “This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.” Google said ShinyHunters might stop using the ‘%50’ bypass and instead adopt other percent-encoded or mixed-case forms of ‘/PSEMHUB/’ to evade WAF rules. Restricting these admin endpoints does not break normal user sessions.

ShinyHunters deployed web shells named x.jsp, u.jsp, and u2.jsp for command execution and file uploading on compromised systems. On compromised Windows servers, the group used those shells to deploy an executable called Ple64.exe that pretends to be a signed Light Alloy media player installer but installs the SIDEEYE backdoor tracked by Google. The group also deployed the open-source Neo-reGeorg tunneling toolkit through tunnel.jsp and tunnel.jspx files, letting SOCKS5 proxy traffic move over normal HTTP and HTTPS connections from the compromised server. Mandiant also saw ShinyHunters rely on legitimate MeshAgent remote management software to keep access to compromised Linux systems.

ShinyHunters is a financially-motivated group with a history of large-scale data theft and extortion. ShinyHunters has operated since 2019 and Mandiant describes the group as multiple threat clusters operating under a shared brand, tracking the specific PeopleSoft campaign under the identifier UNC6240. Google Mandiant tracks ShinyHunters as UNC6240 and describes it as a decentralized network of threat clusters under the ShinyCorp brand, also tracked as sp1d3rhunters or shinyc0rp across Telegram channels. ShinyHunters sits within the broader The Com criminal ecosystem alongside affiliates including Scattered Spider and Lapsus$.

Decryption Digest reports ShinyHunters is responsible for more than 400 confirmed organizational breaches and an estimated 1.79 billion cumulative stolen records. ShinyHunters had earlier leaked data taken from Harvard and the University of Pennsylvania during prior shakedown efforts aimed at colleges and universities. ShinyHunters previously targeted Salesforce Experience Cloud misconfigurations through social engineering including voice phishing in early 2026, affecting organizations such as 7-Eleven, Rockstar Games, and Instructure’s Canvas platform.{

One November 2025 ShinyHunters administrator was identified as a 15-year-old from Jordan.

Halcyon Ransomware Research Center intelligence analyst Erika Totaro said stolen university data keeps giving ShinyHunters a path to run focused campaigns against faculty and students, such as phishing and extortion. That means breach victims face secondary exposure long after the initial intrusion.

An SSRF vulnerability can affect a server without direct public internet exposure. An attacker with a position along a corporate VPN, internal network, or cloud connection path can reach a PeopleSoft instance through that route. A PeopleSoft server reachable over a network, including through a VPN, may be exposed if the PSEMHUB endpoint is accessible along that network path.

Disabling the Environment Management Hub service in multi-server configurations or removing the PSEMHUB application in single-server configurations removes the vulnerable component from the attack surface regardless of network topology. Oracle’s alert advises customers to turn off the Environment Management Hub service in multi-server configurations or delete the PSEMHUB application in single-server configurations when immediate patching is not an option. Restricting these admin endpoints does not break normal user sessions.{

Mandiant told organizations running Oracle PeopleSoft to block external access to endpoints right away and to review WebLogic access logs for suspicious requests tied to external IP addresses. Researchers said to check the PSEMHUB web application directory for JSP files that look unexpected and to review filesystem paths for unauthorized activity.

Defenders should review PeopleSoft access logs going back to at least May 27, 2026, for connections from ShinyHunters infrastructure IP addresses 142.11.200.186 through 142.11.200.190, 108.174.202.99, and 176.120.22.24. Defenders should also check PeopleSoft servers for unauthorized access to /OA_HTML/runforms.jsp and /OA_HTML/JavaScriptServlet, unusual HTTP headers, and unexpected outbound connections. The common name azurenetfiles.net on a TLS certificate is another known indicator of ShinyHunters attacker infrastructure.

When log reviews turn up nothing clear or indicators appear, organizations should bring in incident response resources right away instead of waiting for formal confirmation. If compromise is suspected, organizations should assess breach notification obligations under HIPAA for healthcare data, FERPA for student records, GDPR for European entities, and the UK Data Protection Act 2018. Organizations that rely on vendors running PeopleSoft should confirm patch status for CVE-2026-35273 directly, because a vendor’s unpatched PeopleSoft instance is a supply chain risk.

It remains unclear whether the patch removes access an attacker already obtained; Oracle’s alert does not say, while Mandiant’s credential-rotation and web-shell hunting advice assumes it does not. Mandiant says any host running a web shell should be treated as compromised, with evidence preserved and all credentials reachable from that tier changed.

As of October 28, 2026, only CVE-2026-35273 from June appears on the record despite ZDI’s request for separate CVEs for each of the three vulnerabilities. The chain shows how a single trust decision—allowing loopback access by default—turned an SSRF into unauthenticated remote code execution, and the September WAF bypass demonstrates that network controls alone cannot replace patching.{