ALERT · Actively exploited. Last updated 28 October 2026. See the Alert Tracker
If you run Oracle PeopleSoft with PeopleTools 8.61 or 8.62, treat CVE-2026-35273 as urgent. Mandiant reports renewed mass exploitation by UNC6240 (ShinyHunters). Patch if you have not; hunt Integration Gateway and Environment Management Hub paths even if you have.
What it is
Oracle’s security alert (opens in a new tab) rates CVE-2026-35273 Critical (CVSS 3.1 9.8). ZDI (opens in a new tab) (27 October) says Oracle’s single CVE covers three flaws: Integration Gateway SSRF (/PSIGW/HttpListeningConnector) that can POST to localhost and pass PSEMHUB’s validateClient allow-list, then PSEMHUB path-control file write and/or XMLDecoder deserialization under envmetadata. Separate CVEs are pending, per ZDI. See also Trend research (opens in a new tab).
Who is affected
PeopleTools 8.61 and 8.62 with a reachable Integration Gateway. Mandiant’s 25 September update (opens in a new tab) describes targeting across higher education, technology, healthcare, government and other sectors. WAF rules that match the literal path /PSEMHUB/ before URL-decoding are bypassed with /%50SEMHUB/.
Exploitation status
CISA listed the CVE in KEV on 12 June 2026 (due 15 June; ransomware use Known). FIRST EPSS on 27 October: about 0.967 (99.9th percentile). Mandiant reports MeshCentral agents among post-compromise tooling.
Fix and mitigation
Apply Oracle’s June 2026 out-of-band PeopleTools patches for 8.61/8.62. Restrict or disable internet-facing PSIGW connectors; do not rely on string-match WAF alone. Review hosts for unexpected MeshCentral and for writes under envmetadata.
How to hunt
Draft Hunt Lab package: proxy/web hits to /PSIGW/HttpListeningConnector that also name PSEMHUB, localhost or 127.0.0.1, plus /%50SEMHUB/; and file creates under envmetadata. Review: Hunt Lab PR #4 (opens in a new tab) (experimental; not on main).
Sources
- Oracle Security Alert CVE-2026-35273 (opens in a new tab)
- CISA KEV (opens in a new tab) (dateAdded 2026-06-12, dueDate 2026-06-15, ransomware Known)
- Mandiant / GTIG — ShinyHunters PeopleSoft campaign (opens in a new tab) (25 September 2026)
- ZDI — SSRF to RCE in PeopleSoft (opens in a new tab) (27 October 2026)
- Trend Micro — PSIGW SSRF chain (opens in a new tab)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)