ShinyHunters Used Three‑Step Oracle PeopleSoft Exploit Chain for Unauthenticated Remote Code Execution
New analysis shows the Oracle PeopleSoft zero‑day used by the ShinyHunters group was a chain of three flaws, beginning with a server‑side request forgery issue that bypassed internal access controls and ended in unauthenticated remote code execution, all fixed under CVE‑2026‑35273.
The Oracle PeopleSoft breach linked to ShinyHunters is now understood to be more technically involved than a single coding mistake. Fresh analysis shows the group’s zero‑day attack relied on three vulnerabilities chained together, starting with a server‑side request forgery (SSRF) bug and ending in unauthenticated remote code execution on affected systems. Oracle addressed all three under one identifier, CVE‑2026‑35273.
Investigators say the attack sequence opened with exploitation of an SSRF flaw in PeopleSoft. SSRF weaknesses let an attacker trick a server into sending requests to internal services that are not normally exposed to the internet. In this case, the bug allowed ShinyHunters to reach internal endpoints that were meant to be protected by network boundaries and access rules.
Once the attackers could reach those internal components, they chained further flaws to sidestep remaining authorization checks and execute code. The combined effect was to erase the separation between outside, unauthenticated users and the core logic of the PeopleSoft application. The end state was remote code execution without valid credentials.
For organizations that run PeopleSoft for functions such as payroll, human resources, finance or supply management, that level of access comes with obvious risks. These deployments often hold large volumes of personal and corporate data. An attacker able to run code on the underlying servers can steal information, plant backdoors and move deeper into the rest of the network.
The fact that Oracle assigned a single CVE to three linked vulnerabilities illustrates how a brief patch description can hide a more complex risk picture. Administrators who only confirm that CVE‑2026‑35273 has been applied, without understanding how the exploit worked, may miss chances to tighten network segmentation, reduce unnecessary internal exposure and improve monitoring for suspicious internal requests.
The incident also highlights how long‑lived business software carries design assumptions from earlier security eras. PeopleSoft was built around the idea that internal zones and perimeter firewalls provided strong protection. Modern attackers like ShinyHunters focus on turning edge bugs—such as SSRF—into ways to generate traffic that looks like it originates from inside those trusted zones.
Because PeopleSoft often sits at the center of an organization’s processes, compromise there can ripple widely. Integrations with identity systems, file repositories or other business platforms give an intruder paths to spread influence and gather more data.
Key developments to watch include how quickly remaining exposed systems are patched for CVE‑2026‑35273, whether incident responders uncover more previously unseen intrusions attributed to this exploit chain, and whether similar SSRF‑based techniques start to appear against other major enterprise platforms.
Sources
- OSINT