Oracle Bundled Three Chained PeopleSoft Flaws Into One CVE as ShinyHunters Used Them for Remote Code Execution
New analysis finds the Oracle PeopleSoft zero‑day used by ShinyHunters was a chain of three flaws, all folded into CVE‑2026‑35273, that enabled unauthenticated remote code execution via a server‑side request forgery.
New technical details about a recent Oracle PeopleSoft zero‑day are turning it into a bigger headache for corporate defenders. Analysis published on 28 October shows that the exploit used by the ShinyHunters group was not a single bug but a chain of three distinct vulnerabilities, all tracked under one identifier, CVE‑2026‑35273. Combined, they allowed an attacker on the internet to abuse a server‑side request forgery (SSRF) issue, bypass internal access controls, and gain unauthenticated remote code execution on widely used enterprise systems.
The breakdown describes the first step as an SSRF flaw that let an attacker co‑opt a PeopleSoft server to make internal network calls on their behalf. In environments where internal APIs, administrative interfaces, or data stores are assumed to be shielded from the public internet, that kind of access opens paths that administrators did not plan for. By directing forged requests at internal components with weak authentication or input checks, an intruder could move past the boundaries network architects expected to hold.
Once that inner layer was reached, the remaining flaws in the chain provided a route to run code remotely without any valid login. For an operator like ShinyHunters, that level of control over a PeopleSoft application server is enough to extract sensitive data, plant persistent access, or pivot deeper into connected corporate systems.
For organizations that use PeopleSoft for HR, payroll, or finance, the technical nuance has clear consequences. These deployments often store employee salary data, national ID or Social Security numbers, addresses, and sometimes health or performance information. If attackers exploited the chained vulnerabilities before patches were applied, they could have accessed that data without triggering basic credential‑based alerts.
The fact that three separate issues were patched under one CVE complicates risk triage. Security teams that saw only a single identifier may have treated it as a narrower problem or focused on one obvious symptom. Vendors sometimes group related bugs in the same logical component into one CVE, but in this case the exploitation path crossed several layers of trust inside the application.
ShinyHunters, already known for large‑scale data theft, have shown sustained interest in high‑value enterprise software. The PeopleSoft exploit fits a pattern of targeting complex application stacks that hold concentrated troves of information.
Enterprise defenders now face questions that go beyond installing Oracle’s fix. They will need to check historical logs for signs of SSRF activity tied to PeopleSoft, review how internal services behind the application are exposed, and reassess how much trust those systems place in traffic that appears to originate from inside the network.
Key indicators to watch include any impact statements from Oracle or major customers, possible regulatory scrutiny of past exploitation and breach notification, and updates from security vendors as they add specific detections for the SSRF‑to‑RCE chain behind CVE‑2026‑35273.
Sources
- OSINT