Oracle PeopleSoft Zero-Day Vulnerability Allows Remote Code Execution
Picus Security reports on a critical zero-day vulnerability in Oracle PeopleSoft Enterprise PeopleTools, exploited before a patch. The flaw allows attackers to execute arbitrary code remotely without authentication.
Cybersecurity firm Picus Security has detailed a critical vulnerability, designated CVE-2026-35273, affecting Oracle PeopleSoft Enterprise PeopleTools. This zero-day flaw, carrying a CVSS score of 9.8, permits unauthenticated remote code execution (RCE).
The vulnerability was actively exploited in the wild before Oracle released a patch. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog. Versions PeopleTools 8.61 and 8.62, particularly those with an internet-facing Environment Management Hub, are considered urgently vulnerable.
The threat group UNC6240, publicly known as ShinyHunters, has been linked to exploiting this vulnerability. The group has primarily targeted the higher education sector, with indications of data theft and extortion demands. Publicly leaking stolen data on their leak site is a known tactic.
The vulnerability stems from the PeopleSoft Environment Management Hub's /PSEMHUB/hub endpoint failing to securely handle serialized data sent to the server. An attacker can send a specially crafted request, which is deserialized by the server without proper authentication. This allows the attacker to execute arbitrary classes, potentially leading to complete system compromise.
Picus Security offers its platform for organizations to simulate attacks like CVE-2026-35273. This allows companies to test and validate the effectiveness of their existing security controls against emerging threats and mitigate the risk of potential data breaches.