ShinyHunters exploits PeopleSoft zero-day CVE-2026-35273
Oracle mitigates critical PeopleSoft zero-day (CVE-2026-35273, CVSS 9.8) exploited by ShinyHunters gang to breach 300+ instances and steal corporate data.
Sourcebleepingcomputer.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-35273 as exploited in the wild.
Oracle has released emergency mitigations for CVE-2026-35273, a critical zero-day vulnerability in PeopleSoft PeopleTools versions 8.61 and 8.62 that enables unauthenticated remote code execution with a CVSS score of 9.8. The flaw has been actively exploited by the ShinyHunters extortion gang in a widespread data theft campaign targeting enterprise PeopleSoft deployments.
ShinyHunters confirmed to BleepingComputer that they leveraged a "gadget chain" combining old and zero-day vulnerabilities to breach approximately 300 PeopleSoft instances across more than 100 organizations. The threat actor's typical modus operandi involves exfiltrating large volumes of corporate data from cloud SaaS platforms and enterprise systems, then demanding ransom payments to prevent public disclosure. Mandiant CTO Charles Carmakal independently confirmed active exploitation of this vulnerability.
Oracle has issued mitigations ahead of a full patch release. Organizations running affected PeopleSoft versions should immediately apply available mitigations and review access logs for connections from known attacker infrastructure, including IP addresses in the 142.11.200.0/24 range and additional indicators shared by security researchers. ShinyHunters has been linked to multiple high-profile breaches of cloud platforms including Snowflake and Salesforce over the past year.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Source reporting: https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs