Oracle PeopleSoft · Exploitation reported

Analysis: PeopleSoft zero-day used by ShinyHunters was three chained flaws

Oct 27, 2026 · 1 min read

CVE-2026-35273, the Oracle PeopleSoft zero-day exploited by the ShinyHunters group according to The Hacker News, actually bundles three chained flaws. An SSRF bypasses internal access controls and enables unauthenticated remote code execution. All three were already patched under this single CVE; PeopleSoft instances should be updated.

By HIFY Radar newsroom Updated 10/28/2026 03:08 AM Get this every day →← Back to the feed 2 sources

CriticalVulnerabilityExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A technical analysis released on October 28 reveals that Oracle PeopleSoft CVE-2026-35273 bundles three chained flaws fixed in a single patch. The flaw was used in recent attacks attributed to the ShinyHunters group by The Hacker News. With the full chain, an attacker runs code on the server without credentials.

Why it matters

PeopleSoft holds core corporate HR data and internal processes. With unauthenticated remote code execution, an attacker takes over the server and compromises that data. The flaw has already been used in recent attacks, according to ZDI and The Hacker News.

What to do

Apply the CVE-2026-35273 fix to every Oracle PeopleSoft instance now. Then review logs on PeopleSoft servers for suspicious activity that predates the patch.

For the technical team

CVE: CVE-2026-35273
Affected: Oracle PeopleSoft · Oracle PeopleSoft; specific versions not cited in the sources.
Exploitation: Exploitation in recent PeopleSoft attacks reported by ZDI; ZDI published root cause analysis and a video demo. The Hacker News calls the flaw a zero-day and attributes the exploitation to the ShinyHunters group. The sources cite no public PoC and no KEV listing.
Fix: All three flaws were patched under the single CVE-2026-35273 (The Hacker News). Specific fixed versions not cited in the sources.
Vector: Oracle PeopleSoft; chain of three flaws patched under a single CVE (CVE-2026-35273). The analysis points to an SSRF that bypasses internal access controls and leads to unauthenticated remote code execution; the full chain requires no credentials.
More details: Deep dive published by ZDI researcher bobbygould5, with root cause and video demonstration. Timeline: incident opened on 2026-10-27; analysis revealing the three-flaw chain released on 2026-10-28.

Timeline

10/28/2026 03:08 AM
New technical analysis reveals CVE-2026-35273 bundles three chained flaws, with SSRF leading to unauthenticated RCE, all already patched.
10/27/2026 01:43 PM
Incident opened.