ShinyHunters exploits PeopleSoft RCE since May
Oracle PeopleSoft versions 8.61 and 8.62 contain an actively exploited unauthenticated remote code execution vulnerability tracked as CVE-2026-35273.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-35273 as exploited in the wild.
CERT-FR has issued an advisory for CVE-2026-35273, a critical remote code execution vulnerability affecting Oracle PeopleSoft versions 8.61 and 8.62. The flaw allows unauthenticated attackers to execute arbitrary code remotely on vulnerable systems.
Mandiant reports that this vulnerability has been actively exploited in the wild since at least May 27, 2026. According to Mandiant's threat intelligence, the ShinyHunters threat actor has been leveraging this Oracle exploit to target organizations in the education sector.
Oracle has released security patches addressing this vulnerability. Organizations running affected PeopleSoft versions should apply the vendor's patches immediately given the confirmed active exploitation.
Mentioned in this report
Detection guidance
Suspicious Shell Spawned by Java/PeopleSoft Application Process (Windows)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects cmd.exe or powershell.exe spawned by a Java-based application server process (e.g., WebLogic/Tomcat hosting PeopleSoft), consistent with RCE exploitation such as CVE-2026-35273. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned by Java Process on Windows
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
- \certutil.exe
- \whoami.exe
- \net.exe
filter:
CommandLine|contains:
- JAVA_HOME
- catalina
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or monitoring agents invoked from Java application
server processes
- Backup or patching tools that shell out from application server accounts
level: high
tags:
- attack.t1190
id: 076f374c-6c5c-5182-b98f-8f7341a6662d
status: experimental
author: Vorant
Shell Spawned by Java Process on Linux (Possible PeopleSoft RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell process (sh/bash/dash) spawned directly from a Java process, consistent with exploitation of an unauthenticated RCE flaw in a Java-based enterprise application such as PeopleSoft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by Java Process on Linux
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: java
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
- /bin/ksh
filter:
CommandLine|contains:
- catalina.sh
- startup.sh
- shutdown.sh
condition: selection and not filter
falsepositives:
- Legitimate startup/shutdown scripts executed by the application server's Java process
- Scheduled maintenance scripts that shell out from the app server service account
level: high
tags:
- attack.t1190
id: 5b16cd66-6763-5164-b934-fabcf8a8b024
status: experimental
author: Vorant
Outbound Network Connection from Java Application Server to Uncommon Port
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java-based application server process (potentially exploited PeopleSoft/WebLogic instance) initiating outbound connections to non-standard high ports, which may indicate a reverse shell or C2 callback following RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Outbound Connection to Uncommon Port
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \java.exe
- \javaw.exe
Initiated: true
filter:
DestinationPort:
- 443
- 80
- 8080
- 1521
- 8443
condition: selection and not filter
falsepositives:
- Java application legitimately connecting to external APIs, license servers, or databases
on non-standard ports
- Monitoring/telemetry agents bundled with the application server
level: medium
tags:
- attack.t1190
id: 6a0c1529-f28a-57ac-b0e9-59d5fa00772d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0749
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs