A Zero Day Initiative analysis published October 27 says Oracle PeopleSoft vulnerability CVE-2026-35273 is actually a chain of three flaws spanning the Integration Gateway and Environment Management Hub components. ZDI said it is working with Oracle to assign separate CVEs, but the three issues remain covered by the single identifier. ZDI’s technical analysis describes a path from server-side request forgery to remote code execution.
The affected product is PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. The Hacker News reports that the vulnerability allows an unauthenticated attacker to take over the server over the network. The chain begins when the Integration Gateway can be made to forward attacker-controlled requests to an internal address. The Environment Management Hub then trusts the loopback address, 127.0.0.1, by default. ZDI identified two subsequent execution paths: writing a web shell to an attacker-selected location or placing a malicious XML file that is processed when the service initializes.
The vulnerability carries a CVSS score of 9.8. The Hacker News reports that Oracle released an out-of-band fix on June 10 and that the issue is listed in CISA’s Known Exploited Vulnerabilities catalog. The same report says Mandiant and Google Threat Intelligence Group attributed exploitation from May 27 through June 9 to UNC6240, also known as ShinyHunters, initially targeting mostly universities. The Hacker News’ report says a later wave expanded to sectors including technology, healthcare, transport and government.
The reporting establishes exploitation and the vendor’s June fix, but not whether applying that fix removes access gained before patching. The Hacker News says Mandiant’s response guidance includes credential rotation and hunting for web shells, while noting that patching alone does not establish that an already-compromised system has been cleared.