CVE-2026-35273 (CVSS 9.8): Oracle PeopleSoft’s Three-Chained Zero-Day — ZDI Reveals Full RCE Chain After 100+ Org Breach Wave

Oracle PeopleSoft — used by governments, universities, and large enterprises across India and globally for critical HR and finance operations — has been at the centre of one of 2026’s most methodical breach campaigns. As of October 28, 2026, researchers at Trend Micro’s Zero Day Initiative (ZDI) have publicly dissected the full attack chain, revealing that CVE-2026-35273 is not one vulnerability but three chained flaws that together allow completely unauthenticated remote code execution. The breach wave struck more than 100 organisations before Oracle’s emergency patch arrived in June. If you are still running PeopleTools 8.61 or 8.62 without the June 10 out-of-band update, you are exposed — and attackers are actively hunting bypass paths.

How the Three-Chain Attack Works

Oracle patched everything under the single umbrella identifier CVE-2026-35273, but ZDI’s analysis makes clear that what looks like one bug is actually an ordered chain of three exploitable weaknesses, any one of which breaks the attack if absent.

Stage 1 — SSRF via the PSIGW Gateway: PeopleSoft’s Integration Gateway (/PSIGW/) accepts inbound service requests and, by design, forwards certain messages to the application tier on the loopback address. Because the server trusts its own loopback, an attacker can reach internal endpoints that are never meant to be accessible from the internet — no credentials required. This is the Server-Side Request Forgery root (CWE-918) that ZDI’s Bobby Gould identifies as the anchor of the chain.

Stage 2 — Unauthenticated Access to the Hub Endpoint: The SSRF tunnels the attacker’s payload to /PSEMHUB/hub, PeopleSoft’s internal message hub. Under normal circumstances, only authenticated internal processes reach this endpoint. Arriving via loopback spoofs that trust, bypassing the authentication gate — a missing authentication check (CWE-306).

Stage 3 — XMLDecoder Deserialization to RCE: The hub endpoint passes the attacker-controlled payload to Java’s XMLDecoder inside the application server’s own JVM. XMLDecoder is notoriously dangerous when fed untrusted input: it instantiates arbitrary Java objects, allowing OS command execution. Trend Micro’s research notes that code-execution fires on the next server restart rather than immediately on the inbound request — a subtlety that complicates both detection and forensics.

Chained together, the sequence delivers pre-authentication remote code execution from any internet-facing PeopleSoft instance running the affected versions — no username, no password, no social engineering.

Stage	Component	Weakness (CWE)	Effect
1	PSIGW Gateway	SSRF (CWE-918)	Reach internal loopback
2	PSEMHUB Endpoint	Missing Auth (CWE-306)	Bypass authentication gate
3	XMLDecoder / JVM	Unsafe Deserialization (CWE-502)	Arbitrary OS command execution

Six Weeks of Silent Exploitation

Google Threat Intelligence Group (GTIG) and Mandiant attributed the initial breach wave to UNC6240, the cluster publicly known as ShinyHunters. Activity began on May 27, 2026 — well before the June 10 patch — and continued through June 9. During those thirteen days, the group targeted universities and higher-education institutions across North America and Europe in what researchers describe as a fast-moving, opportunistic scan-and-exploit campaign.

Post-exploitation followed a consistent pattern: ShinyHunters deployed the SIDEEYE backdoor, a Windows-native implant that harvests stored credentials and establishes persistent remote control. In some intrusions the group claimed to pivot from PeopleSoft into AWS GovCloud tenancies co-hosting application data, though those claims remain independently unverified.

The University of Nottingham has been confirmed as an early victim. ShinyHunters later claimed in September to have used the same chain to breach FBI contractor systems, stating it exfiltrated 2–3 TB of data and providing a sample of approximately 5,000 records to journalists. The FBI has characterised the event as a contractor failure to apply an available patch; Oracle has not confirmed a new zero-day in connection with that incident. That specific claim is unverified and contested — it is mentioned here for context, not as established fact.

What is confirmed: across the campaign, more than 100 organisations were targeted, the majority in the education and government sectors. For large Indian enterprises running PeopleSoft for HR and payroll — and there are many, particularly in IT services, banking, and public-sector undertakings — the lesson is uncomfortable: a CVSS 9.8 RCE was actively exploited for thirteen days before Oracle issued an emergency fix.

This mirrors a pattern Sanjay Seth has documented repeatedly in 2026, from the Arista VeloCloud SD-WAN exploitation wave to the AI-assisted supply-chain attacks by Storm-0940: attackers exploit the gap between vulnerability disclosure and enterprise patch deployment, and that gap in large PeopleSoft environments can be measured in months, not days.

Why ZDI’s October 28 Analysis Changes the Risk Calculus

When The Hacker News published ZDI’s breakdown on October 28, 2026, the disclosure shifted from “patch a known CVE” to “understand a multi-stage attack surface.” ZDI has notified Oracle that three distinct vulnerabilities need three distinct CVE identifiers. As of writing, Oracle has not assigned those separate IDs, which means vulnerability scanners and SIEM correlation rules keyed to a single CVE may be missing part of the exposure picture.

Crucially, ZDI noted that renewed ShinyHunters activity after the June patch appears to target systems where the fix was partially applied or where WAF rules were added as the only mitigation. WAF rules can block specific known request patterns, but they cannot close the underlying SSRF and deserialization chain — they are speed bumps, not a fix. If your team applied a WAF rule instead of the Oracle patch because downtime was inconvenient, your system is still vulnerable.

The CVSS 9.8 score reflects the worst-case: unauthenticated, network-reachable, low complexity, no user interaction needed. The only silver lining: the three-stage chain means a defender who severs any one link — by properly segmenting the PSIGW gateway from the internet, or by isolating the PSEMHUB endpoint — can break the full chain without patching, as an emergency stop-gap while scheduling downtime.

What You Should Do: Sanjay Seth’s Defensive Playbook

From a zero-trust and enterprise hardening perspective, here is the priority-ordered action list for organisations running PeopleSoft:

1. Apply Oracle’s June 2026 out-of-band patch immediately if you have not already. Confirm via Oracle’s security advisory for CVE-2026-35273. Cloud-hosted PeopleSoft (Oracle SaaS) received automatic updates — on-premises and hosted customers must act manually.
2. Never treat a WAF rule as a substitute for patching. WAF mitigations for CVE-2026-35273 block known patterns; ZDI has shown that WAF-bypass variants are already in use. The patch closes the underlying SSRF and deserialization sinks.
3. Segment the PSIGW gateway. If immediate patching is impossible, place the PSIGW endpoint behind an application delivery controller that denies inbound routing to loopback addresses. The SSRF is the first link in the chain; deny it network-level access and you break the full sequence.
4. Hunt for SIDEEYE IOCs across all Windows servers in the PeopleSoft application tier. SIDEEYE persists in startup items and scheduled tasks. Indicators of compromise — file hashes and C2 patterns — are available in Trend Micro’s full technical analysis.
5. Audit credential stores on PeopleSoft application servers. ShinyHunters specifically targeted stored credentials. Rotate service account passwords, revoke any tokens or API keys scoped to PeopleSoft integrations, and verify that no new administrator accounts have been created post-May 2026.
6. Review your vulnerability scanner CVE coverage. Until Oracle issues three separate CVE IDs, scanners tuned only to CVE-2026-35273 may not flag every sub-component. Work with your scanner vendor to ensure the PSIGW and PSEMHUB endpoints are tested as discrete attack surfaces.
7. Treat PeopleSoft like internet-facing infrastructure. Many organisations treat it as an internal system — it is not. It serves employees, integrates with external payroll and government systems, and often terminates authentication flows from the public internet. Apply the same hardening posture you would to a web application firewall or API gateway.

For Indian enterprises: CERT-In’s advisory framework requires organisations under the IT (Amendment) Act to report incidents within six hours of discovery. If your PeopleSoft instance was internet-facing and unpatched between May and June 2026, a retroactive audit is advisable — both for regulatory compliance and to confirm no SIDEEYE persistence was established that has since gone dormant.

Frequently Asked Questions

Is my PeopleSoft patched if I applied Oracle’s July 2026 CPU?

The July 2026 Critical Patch Update (CPU) includes the CVE-2026-35273 fix. However, Oracle released this fix as an out-of-band emergency on June 10, 2026 — before the July CPU cycle. If you applied the June out-of-band alert or a later CPU, you are patched. If you skipped the June update and have not yet applied the July CPU, you remain exposed.

Are Oracle Cloud or SaaS PeopleSoft customers affected?

Cloud-hosted and SaaS instances were patched automatically by Oracle. On-premises and customer-managed hosted deployments require manual action. If you are unsure which deployment model you run, check with your Oracle support representative or system integrator.

Can a web application firewall (WAF) protect me while I wait to patch?

A WAF adds a layer of friction but is not a substitute for patching. ShinyHunters’ post-patch activity specifically includes WAF-bypass variants. ZDI’s analysis confirms that organisations relying solely on WAF rules were re-exploited. Patch as a priority; use WAF rules only as an additional control layer, never as the sole defence.

How can I tell if my system was already compromised during the May–June window?

Check for SIDEEYE indicators of compromise using the hashes and C2 domains published in Trend Micro’s research. Review Windows event logs on all PeopleSoft application servers for unexpected scheduled tasks, new local administrator accounts, or unusual outbound connections. Any anomalies from May 27 onward should be treated as a potential intrusion and escalated to your incident-response team or a qualified forensic partner.

---

Protect Your Enterprise Before the Next Chain Drops

CVE-2026-35273 is a reminder that enterprise platforms are high-value targets, and that attackers invest the time to chain three subtle bugs into a single devastating exploit. ZDI’s October 28 disclosure ensures that defenders now have the technical map — the question is whether your organisation will act on it before a threat actor does.

Sanjay Seth and the P J Networks team have spent thirty years hardening enterprise networks for Indian IT leaders. Whether you need a rapid PeopleSoft patch-and-audit engagement, a zero-trust review of your application perimeter, or a threat-hunt across your Windows server estate, we can help you move from vulnerable to verified.

Contact Sanjay Seth for a no-obligation security assessment →