# Oracle PeopleSoft zero‑day was three chained bugs, enabling unauthenticated code execution

*Wednesday, October 28, 2026 at 6:15 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-28T06:15:35.233Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21756.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: New analysis finds that the Oracle PeopleSoft zero‑day exploited by the ShinyHunters group was a chain of three vulnerabilities, all patched under CVE‑2026‑35273. A server‑side request forgery flaw sat at the core of an exploit path that bypassed internal access controls and allowed unauthenticated remote code execution.

The Oracle PeopleSoft weakness abused in recent attacks was more complex than a single programming mistake, and that matters for anyone still assessing their exposure.

Technical analysis published on 28 October shows that the zero‑day in Oracle PeopleSoft used by ShinyHunters was in fact a chain of three separate vulnerabilities. Oracle rolled all of them into one patch and one identifier, CVE‑2026‑35273.

At the center of the chain was a server‑side request forgery (SSRF) flaw. That weakness let an attacker manipulate the application into sending crafted requests to internal services that should have been shielded by access controls. Combined with the other issues, it provided a route around those internal protections.

Used together, the three bugs allowed unauthenticated remote code execution on affected PeopleSoft systems. In effect, an attacker who could reach a vulnerable PeopleSoft instance over the network could run code on the server without first obtaining valid login details.

By packaging all three problems under a single CVE, Oracle delivered one fix but also obscured how many distinct steps were involved in the exploit. Organizations that only track the identifier may underestimate the sophistication of the attack path and overlook where similar patterns might recur elsewhere in their environments.

For administrators responsible for PeopleSoft, the analysis underlines why this particular patch can’t be treated as a routine update. A working chain that moves from external access to unauthenticated code execution against a core business platform gives attackers a strong foothold in networks that often handle payroll, finance or records.

Signals to watch now include whether incident reports continue to point back to CVE‑2026‑35273, whether proof‑of‑concept exploit code becomes more widely circulated, and how quickly remaining vulnerable systems are updated or taken offline.