VORANT. Threat Intelligence Sign in Get the full feed

ShinyHunters exploits PeopleSoft RCE since May

high threat education

Oracle PeopleSoft versions 8.61 and 8.62 contain an actively exploited unauthenticated remote code execution vulnerability tracked as CVE-2026-35273.

CERT-FR has issued an advisory for CVE-2026-35273, a critical remote code execution vulnerability affecting Oracle PeopleSoft versions 8.61 and 8.62. The flaw allows unauthenticated attackers to execute arbitrary code remotely on vulnerable systems.

Mandiant reports that this vulnerability has been actively exploited in the wild since at least May 27, 2026. According to Mandiant's threat intelligence, the ShinyHunters threat actor has been leveraging this Oracle exploit to target organizations in the education sector.

Oracle has released security patches addressing this vulnerability. Organizations running affected PeopleSoft versions should apply the vendor's patches immediately given the confirmed active exploitation.

Mentioned in this report

Vulnerabilities CVE-2026-35273KEV
Threat actors ShinyHunters

Detection guidance

Suspicious Shell Spawned by Java/PeopleSoft Application Process (Windows)

ATT&CK T1190

Detects cmd.exe or powershell.exe spawned by a Java-based application server process (e.g., WebLogic/Tomcat hosting PeopleSoft), consistent with RCE exploitation such as CVE-2026-35273. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Shell Spawned by Java Process on Windows
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    - \certutil.exe
    - \whoami.exe
    - \net.exe
  filter:
    CommandLine|contains:
    - JAVA_HOME
    - catalina
  condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or monitoring agents invoked from Java application
  server processes
- Backup or patching tools that shell out from application server accounts
level: high
tags:
- attack.t1190
id: 076f374c-6c5c-5182-b98f-8f7341a6662d
status: experimental
author: Vorant

Shell Spawned by Java Process on Linux (Possible PeopleSoft RCE)

ATT&CK T1190

Detects a shell process (sh/bash/dash) spawned directly from a Java process, consistent with exploitation of an unauthenticated RCE flaw in a Java-based enterprise application such as PeopleSoft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned by Java Process on Linux
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: java
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    - /bin/ksh
  filter:
    CommandLine|contains:
    - catalina.sh
    - startup.sh
    - shutdown.sh
  condition: selection and not filter
falsepositives:
- Legitimate startup/shutdown scripts executed by the application server's Java process
- Scheduled maintenance scripts that shell out from the app server service account
level: high
tags:
- attack.t1190
id: 5b16cd66-6763-5164-b934-fabcf8a8b024
status: experimental
author: Vorant

Outbound Network Connection from Java Application Server to Uncommon Port

ATT&CK T1190

Detects a Java-based application server process (potentially exploited PeopleSoft/WebLogic instance) initiating outbound connections to non-standard high ports, which may indicate a reverse shell or C2 callback following RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Outbound Connection to Uncommon Port
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    Initiated: true
  filter:
    DestinationPort:
    - 443
    - 80
    - 8080
    - 1521
    - 8443
  condition: selection and not filter
falsepositives:
- Java application legitimately connecting to external APIs, license servers, or databases
  on non-standard ports
- Monitoring/telemetry agents bundled with the application server
level: medium
tags:
- attack.t1190
id: 6a0c1529-f28a-57ac-b0e9-59d5fa00772d
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0749

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free