CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.
If you run Oracle PeopleSoft, the emergency was over a month ago and you may not have noticed. ShinyHunters exploited CVE-2026-35273 as a zero-day between May 27 and June 9, 2026 — breaching more than 100 organizations, most of them universities — a full two weeks before Oracle issued its out-of-band alert on June 10. Tuesday's July Critical Patch Update is the permanent fix rolled into Oracle's regular cycle. If you patched off the June alert, good. If you've been waiting for the quarterly CPU, you've been exposed the entire time.
What the vulnerability actually does
The headline says "remote code execution," which is true but skips the interesting mechanics. Rapid7's analysis describes the core flaw as a server-side request forgery in PeopleTools' Environment Management component. SSRF means the attacker doesn't run code directly at first — they trick the server into making requests on their behalf. Here that's weaponized to force the PeopleSoft host into outbound SMB connections on TCP 445, which can leak Windows machine-account NetNTLM hashes, and — chained with CVE-2026-35278 — escalates to full unauthenticated code execution on the application server and the box under it.
No login. No user interaction. Network access to the web tier over HTTP is the entire prerequisite. That's the profile that gets a bug a 9.8 and puts it on every incident responder's Monday-morning list.
CVE-2026-35273 at a glance
CVSS score
Detail
9.8 (Critical)
Vulnerability class
Detail
SSRF → unauthenticated RCE (chained)
Affected
Detail
PeopleTools 8.61, 8.62
Authentication required
Detail
None
Exploited in wild
Detail
Yes — May 27–June 9, 2026 (zero-day)
Threat actor
Detail
UNC6240 / ShinyHunters
In CISA KEV
Detail
Yes (added June 12, 2026)
Fix
Detail
July 2026 CPU / June out-of-band patch
Detail
CVSS score
9.8 (Critical)
Vulnerability class
SSRF → unauthenticated RCE (chained)
Affected
PeopleTools 8.61, 8.62
Authentication required
None
Exploited in wild
Yes — May 27–June 9, 2026 (zero-day)
Threat actor
UNC6240 / ShinyHunters
In CISA KEV
Yes (added June 12, 2026)
Fix
July 2026 CPU / June out-of-band patch
PeopleSoft runs the HR and finance backbone of large institutions — which is exactly why an extortion crew went after it. · Pexels
Why patching alone isn't the whole job
Here's the part I think gets under-said in the rush to say "patch now." This was exploited as a zero-day for two weeks before anyone had a fix. That means the population of systems that could already be compromised includes machines whose admins did nothing wrong — there was no patch to apply. Installing the July CPU closes the door, but if someone walked through it in early June, the door being shut now doesn't evict them.
ShinyHunters is a data-theft-and-extortion group, not a smash-and-grab. Rapid7 documented post-exploitation involving MeshCentral remote-management agents for persistence and data exfiltration compressed with zstd. Persistence is the point — so the response has to assume they may have established it.
Apply the July 2026 Critical Patch Update to PeopleTools 8.61/8.62 immediately — or the June out-of-band patch if you can't take the full CPU yet.
Block external access to /PSEMHUB/hub and /PSIGW/HttpListeningConnector at the firewall. Most orgs never need these exposed to the internet.
Hunt, don't assume: check for MeshCentral or other unexpected remote-management agents, and review outbound SMB (TCP 445) traffic from PeopleSoft hosts.
Rotate the machine-account and service credentials on affected hosts — NetNTLM hash exposure is part of this bug's mechanism.
If you find a foothold, treat it as an incident: the actor's goal was data theft, so scope what was reachable before deciding it was 'just' a patch.
The pattern worth noticing
Two of the last three Oracle PeopleSoft security stories have followed the same shape: a pre-auth flaw in an internet-facing enterprise app, exploited quietly for weeks, disproportionately hitting education because universities run big PeopleSoft installs with lean security teams and long change-freeze windows. If that's you, the lesson isn't only "patch this CVE." It's that the Environment Management and Integration Gateway endpoints are a recurring soft spot, and leaving them reachable from the open internet is a standing bet you keep having to win.
Quick answers
Am I affected if I run an older PeopleTools version?
Oracle's advisory names 8.61 and 8.62 as affected for CVE-2026-35273. Older branches aren't listed for this specific CVE, but the July Critical Patch Update fixes many other PeopleSoft and Oracle issues — check the full CPU against your exact version rather than assuming an older build is safe overall.
Is there a working exploit publicly available?
It's been exploited in the wild by a named threat group and is in CISA's KEV catalog, which is the practical bar that matters — treat it as fully weaponized regardless of whether a public proof-of-concept has been posted. Waiting for 'confirmed public PoC' before patching a 9.8 that's already been used is the wrong order of operations.
We patched in June. Are we done?
Patching closes the vulnerability, but because it was a zero-day exploited before the fix existed, you should still verify you weren't compromised in the exposure window — check for persistence mechanisms and unusual outbound traffic. Patching and hunting are two separate jobs here.
How is this different from the WordPress RCE you covered?
Different stack, same lesson: an unauthenticated remote-code-execution bug in widely-deployed software is the highest-priority class of vulnerability there is. We wrote up a WordPress case recently where the fix was equally urgent. The playbook — patch fast, assume nothing, verify — is the same whether it's a CMS or an enterprise HR platform.
