Zero Radar
← feed
CriticalVulnerabilityCVE-2026-35273updated 28 Oct 2026, 07:15 UTC

Oracle PeopleSoft flaw chained from three bugs, exploited by ShinyHunters

Attackers can trick Oracle PeopleSoft into reaching its own hidden admin area, which can let them take control of the system. A criminal group called ShinyHunters has been using it since May.

Attacks reported (The Hacker News)Fix available1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
Fix available?YesPatches released by Oracle in June under CVE-2026-35273 (specific fixed versions not stated in the source material) · since 28 Oct 2026
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker sends requestCrafted request sent to PeopleSoft
  2. 2SSRF triggeredServer is tricked into requesting itself
  3. 3Loopback trustedPeopleSoft trusts its own loopback address
  4. 4Internal interface reachedManagement interface becomes accessible
  5. ResultAttacker reaches internal management functions

What happened

A critical Oracle PeopleSoft vulnerability, tracked as CVE-2026-35273, is actually three chained flaws. The root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address.

Why it is dangerous: Attackers exploiting this can reach internal management functions that are not meant to be exposed, putting data and the PeopleSoft system itself at risk. Organizations running PeopleSoft that have not applied the June patch are exposed.

Are you affected?

You are affected if you run Oracle PeopleSoft with the unpatched versions that predate Oracle's June patch.

Oracle PeopleSoft (specific versions not stated in the source material)

What to do

  1. Confirm your PeopleSoft version and apply Oracle's June 2026 patch for CVE-2026-35273
  2. Review PeopleSoft logs since May 2026 for unusual internal requests or access to management interfaces
  3. Restrict network access to PeopleSoft internal management interfaces

Timeline

  1. 28 Oct 2026, 06:04 UTC
    Publicly disclosed
  2. 28 Oct 2026, 06:04 UTC
    Reported by The Hacker News · The Hacker News
  3. 28 Oct 2026, 07:15 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
CVE-2026-35273
EPSS
97% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 06:04 UTC
On Zero Radar
28 Oct 2026, 07:15 UTC (1 h after disclosure)
Last change
28 Oct 2026, 07:15 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle PeopleSoft flaw chained from three bugs, exploited by ShinyHunters · Zero Radar