# Oracle Issues Critical Warning on PeopleSoft Zero-Day Vulnerability Actively Exploited in Data Theft Campaign


Oracle has disclosed a critical zero-day vulnerability in its PeopleSoft Suite that allows unauthenticated remote code execution, with active exploitation confirmed in data theft attacks by the ShinyHunter threat group. The flaw, tracked as CVE-2026-35273, represents a severe risk to enterprise organizations worldwide that depend on PeopleSoft for human resources, payroll, and financial management.


## The Threat


The vulnerability enables attackers to execute arbitrary code on vulnerable PeopleSoft instances without requiring valid credentials, giving adversaries complete control over affected systems. According to Oracle's security advisory, the flaw has been actively exploited in the wild as part of targeted data theft operations attributed to ShinyHunter, a financially motivated threat group known for stealing corporate and personal data from large organizations.


Key characteristics of the threat:


  • Authentication bypass — Attackers can bypass authentication mechanisms entirely
  • Remote code execution — Full system compromise with no user interaction required
  • Active exploitation — Confirmed in real-world attacks against multiple victims
  • High impact — PeopleSoft systems store sensitive employee, financial, and healthcare data

    • Organizations operating PeopleSoft have been warned to treat this as an immediate security priority. The vulnerability appears in multiple versions of PeopleSoft Suite, affecting both on-premises and cloud deployments.


    ## Background and Context


    PeopleSoft is one of the most widely deployed enterprise resource planning (ERP) and human capital management (HCM) systems globally, used by thousands of organizations across healthcare, finance, manufacturing, government, and retail sectors. The platform manages critical business functions including payroll processing, benefits administration, talent management, and financial reporting.


    Historical context:

  • PeopleSoft has been a perennial target for sophisticated threat actors
  • Previous vulnerabilities have led to multi-million dollar data breaches
  • Enterprise systems like PeopleSoft are high-value targets due to the breadth of sensitive data they contain

    • ShinyHunter's track record:

    The threat group responsible for exploiting this vulnerability has claimed responsibility for data breaches affecting major retailers, financial institutions, and technology companies. The group typically:

  • Targets publicly exposed database access points
  • Exfiltrates customer records, employee data, and financial information
  • Threatens to publish stolen data on underground forums if ransom demands aren't met
  • Operates with sophisticated reconnaissance and persistence techniques

    • The discovery of this zero-day in active use suggests ShinyHunter has maintained undisclosed access to PeopleSoft vulnerabilities—a concerning development that indicates potential supply chain risks or advanced vulnerability discovery capabilities.


    ## Technical Details


    CVE-2026-35273 exploits insufficient input validation in PeopleSoft's web tier authentication layer. The vulnerability allows attackers to craft specially malformed HTTP requests that bypass authentication controls and inject arbitrary code into the application server.


    Attack flow:


    | Step | Description |

    |------|-------------|

    | 1. | Attacker identifies exposed PeopleSoft instance via internet scanning |

    | 2. | Malicious HTTP request with crafted payload is sent to authentication endpoint |

    | 3. | Insufficient input validation allows authentication bypass |

    | 4. | Arbitrary code executes with application server privileges |

    | 5. | Attacker establishes persistence and exfiltrates data |


    Exploitation requirements:

  • Network access to PeopleSoft application server (TCP 8000/8443 typically)
  • No valid credentials needed
  • No user interaction required
  • Single request can achieve code execution

    • The vulnerability resides in PeopleSoft versions 9.2.x through 9.3.x, with Oracle initially reporting that certain patch levels remain unaffected. However, researchers have noted that vulnerable instances are trivially identifiable through banner grabbing and standard reconnaissance techniques, making mass exploitation possible.


    Proof-of-concept code has reportedly been shared in closed threat actor forums, accelerating exploitation velocity across less-patched environments.


    ## Implications for Organizations


    The impact of this vulnerability extends far beyond individual PeopleSoft deployments. Organizations leveraging PeopleSoft for HR and financial management face cascading risks:


    Data theft exposure:

  • Employee personal information (SSNs, dates of birth, addresses)
  • Salary and compensation data
  • Healthcare enrollment and benefits information
  • Financial records and banking details
  • Tax identification documents
  • Direct deposit information

    • Operational disruption:

  • Attackers could modify payroll data, causing payment failures
  • Financial records could be altered, creating audit and compliance issues
  • Talent data could be corrupted, impacting hiring and retention systems

    • Compliance violations:

  • HIPAA violations if healthcare data is compromised
  • SOX violations affecting financial integrity
  • GDPR/CCPA fines for personal data exfiltration
  • State breach notification laws triggering expensive notification campaigns

    • Second-order risks:

  • Compromised credentials could enable lateral movement to other systems
  • Attackers gaining access to finance systems could facilitate fraud
  • Supply chain implications if vendors or partners use the same systems

    • Organizations should assume that if their PeopleSoft systems were publicly exposed or scanned during the vulnerability window, they may have already been compromised.


    ## Recommendations


    Immediate actions (within 24 hours):


    1. Identify affected systems — Audit your environment to locate all PeopleSoft instances and document their versions

    2. Restrict network access — Implement firewall rules limiting PeopleSoft access to authorized networks only; disable external internet exposure if possible

    3. Enable monitoring — Increase logging verbosity on PeopleSoft application and web servers to detect exploitation attempts

    4. Notify security team — Escalate to incident response and threat intelligence teams


    Short-term mitigation (within 1 week):


  • Apply Oracle patches immediately — Oracle released emergency patches; deploy to test environment first, then production
  • Credential rotation — Reset all service accounts and administrative credentials with PeopleSoft access
  • Data breach assessment — Conduct forensic analysis of logs to determine if exploitation occurred; scan for indicators of compromise
  • Segment networks — Isolate PeopleSoft infrastructure from general corporate networks where possible

    • Long-term hardening:


  • Implement Web Application Firewall (WAF) rules specific to PeopleSoft authentication endpoints
  • Deploy endpoint detection and response (EDR) on PeopleSoft application servers
  • Establish vulnerability scanning and patch management SLAs for critical ERP systems
  • Consider architectural redesign to reduce internet exposure of PeopleSoft systems

    • ---


    ## HackWire Analysis


    What makes CVE-2026-35273 particularly alarming is not just its technical severity, but its exploitation timeline and distribution model. Oracle's disclosure reveals that ShinyHunter has weaponized this flaw while it remained unknown to the broader security community—suggesting either advanced vulnerability discovery capabilities or a tip from an insider source.


    The timing also matters: PeopleSoft patches are notoriously difficult to deploy in enterprise environments. Most organizations operate on quarterly or semi-annual patch cycles due to testing requirements and business continuity concerns. This creates a massive window where systems remain vulnerable despite patch availability. We've observed this pattern repeatedly with enterprise software—the gap between patch release and widespread deployment can stretch to 6-12 months in large organizations, especially in regulated industries like healthcare and finance.


    More critically, ShinyHunter's use of this vulnerability for mass data theft rather than targeted espionage indicates that they've industrialized their operation. They're not conducting surgical attacks; they're systematically scanning for vulnerable instances and extracting whatever sensitive data they find. This is the evolution of ransomware tactics: skip the encryption, just steal the data and monetize it through direct sales on crime forums or targeted extortion.


    Organizations should not treat this as a routine patch cycle. The presence of confirmed active exploitation and the breadth of data PeopleSoft systems contain (payroll, healthcare enrollment, financial records) means this rises to CISO-level incident response status. If your organization runs PeopleSoft, you need to assume compromise unless you have forensic evidence proving otherwise.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)