ShinyHunters keeps exploiting Oracle PeopleSoft CVE-2026-35273. How to check your clients' PeopleSoft servers for compromise and lock them down.
ShinyHunters raided university PeopleSoft servers in June, Oracle shipped a fix, and everyone moved on. Then the same gang came back in September for a bigger second helping, and this month a Zero Day Initiative analysis showed the "one bug" Oracle fixed was really three.
If any of your clients run PeopleSoft for HR, payroll or student records, this is the week to confirm the fix is in and that nobody is still inside.
CVE-2026-35273 is a critical, unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, scored CVSS 9.8. PeopleSoft is the HR, payroll and student-records system behind many universities, hospitals and public bodies, so a takeover puts some of an organisation's most sensitive data in reach.
The flaw sits in two PeopleSoft components: the Integration Gateway (PSIGW), which swaps messages with other systems, and the Environment Management Hub (PSEMHUB), an internal admin service. ZDI's write-up says it reported three distinct vulnerabilities across those two components, which Oracle patched under the one CVE, and that it is working with Oracle on separate identifiers. The practical lesson for partners: the hub should never be reachable from outside, and one blocked URL is not the same as a fix.
Yes, in two waves. Mandiant and Google Threat Intelligence tie a zero-day campaign from May 27 to June 9, 2026, mostly against higher education, to UNC6240, better known as ShinyHunters. Oracle released an out-of-band alert on June 10, and CISA added the CVE to its KEV catalog on June 12.
In September, Mandiant reported a renewed mass campaign with web shells on "dozens of systems globally" across technology, IT services, healthcare, agriculture, transportation and government. Mandiant also found the attackers getting past path-based WAF rules, and warns defenders to block on the decoded path rather than the raw text. ShinyHunters steals data and then extorts, so a quiet server is not proof of a clean one.
Start with each client's asset inventory: any PeopleSoft install is a candidate. To spot sign-in pages on hosts you manage, with the client's permission, run this against a list of hostnames in clients.txt:
while read -r H; do
curl -skL -m 10 "https://$H/" | grep -qi 'PeopleSoft Sign-in' && echo "$H PeopleSoft"
done < clients.txt
That page title is the fingerprint runZero uses; our match on it is a name filter, so an empty result does not prove PeopleSoft is absent. On a server you find, psadmin -v prints the release (Oracle's docs show "Version 8.59" as the format). A result of 8.61 or 8.62 is in scope unless Oracle's June fix appears in the client's change records.
Patching closes the hole; it does not remove anyone already inside. On Linux hosts, with $PS_CFG_HOME set as on the PeopleSoft server:
D=/root/ir-peoplesoft-$(date +%F); sudo mkdir -p "$D"
sudo cp -a "$PS_CFG_HOME/webserv" /var/log/nginx /var/log/httpd "$D"/ 2>/dev/null
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
.gz files included, for requests to the hub or gateway and for the network indicators Mandiant published:P='semhub|psigw|5\.199\.162\.157|104\.219\.234\.138|162\.219\.30\.165|winmanage-me\.network'
sudo find "$PS_CFG_HOME/webserv" /var/log/nginx /var/log/httpd -type f -name '*log*' -exec zgrep -EiaH "$P" {} + 2>/dev/null
Any external request to the hub is worth a closer look; legitimate traffic to it comes from inside the PeopleSoft environment.
x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe, and says to check every WebLogic node. Any .jsp or .exe in PSEMHUB.war is suspect, and recent changes in PORTAL.war and the hub's environment folder need review:sudo find "$PS_CFG_HOME/webserv" -path '*PSEMHUB.war*' \( -iname '*.jsp*' -o -iname '*.exe' \) -exec sha256sum {} +
sudo find "$PS_CFG_HOME/webserv" -path '*PORTAL.war*' -iname '*.jsp*' -newermt 2026-05-27 -ls
sudo find "$PS_CFG_HOME/webserv" -path '*envmetadata/data/environment*' -name '*.xml' -newermt 2026-05-27 -ls
On Windows hosts, this scans local fixed disks only and will also list unrelated files with those names:
Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { Get-ChildItem "$($_.DeviceID)\" -Recurse -Force -File -Include x.jsp,u.jsp,u2.jsp,tunnel.jsp,tunnel.jspx,Ple64.exe -ErrorAction SilentlyContinue } | Get-FileHash | Select-Object Hash,Path
ps -eo pid,ppid,user,comm,args --forest | grep -Ei -A3 'weblogic|meshagent'
Then list scheduled jobs for all users with sudo ls -la /etc/cron* /var/spool/cron/*.
Any hit in steps 2 to 4 means treating the host as compromised, as Mandiant advises.
psadmin -v and confirm the release and the change record match. Mandiant is blunt: "WAF rules and path-based blocking are not a substitute for patching."location ~* ^/(psemhub|psigw/httplisteningconnector) { return 403; }
Mandiant says restricting these paths does not break normal user sessions. Pass condition: reload nginx with sudo nginx -t && sudo systemctl reload nginx and confirm both commands exit without errors.
psappsrv.cfg (locate it with sudo find "$PS_CFG_HOME" -name psappsrv.cfg), Integration Broker credentials and any cloud keys, starting with hosts where WebLogic runs as root or SYSTEM. Pass condition: the old passwords are rejected.The hard part of this incident for an MSP is not the patch; it is knowing which clients have a PeopleSoft sign-in page or admin component facing the internet in the first place. KinoSec runs an autonomous pentest of each client's web apps and external network, with their permission and within scope: reconnaissance that finds exposed applications and admin interfaces, testing for vulnerabilities like this one, and a report with remediation you can hand straight to the client. Run it continuously and the next PeopleSoft-style surprise shows up in a report instead of in an extortion email.
CVE-2026-35273 is a CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62. It involves the Integration Gateway and the Environment Management Hub. ZDI says it is three distinct vulnerabilities that Oracle patched under one CVE in June 2026.
First preserve evidence by copying $PS_CFG_HOME/webserv and proxy logs to a dated folder and hashing them. Then search access logs with zgrep -EiaH 'semhub|psigw' plus Mandiant's IPs. Finally run find "$PS_CFG_HOME/webserv" -path '*PSEMHUB.war*' for .jsp and .exe files such as x.jsp, u.jsp and tunnel.jsp.
Install Oracle's Security Alert fix for CVE-2026-35273 from My Oracle Support. Disable the EMHub service on multi-server setups or remove the PSEMHUB application on single-server installs, then block both components at the proxy on the decoded path. Mandiant says WAF rules and path-based blocking are not a substitute for patching.
Mandiant reported a renewed mass campaign in September 2026 that put web shells on "dozens of systems globally", after the first wave from May 27 to June 9, 2026. The September victims spanned technology, IT services, healthcare, agriculture, transportation and government, not only universities.