Back to Blog
    Threat Advisory
    ShinyHunters
    PeopleSoft
    CVE-2026-35273
    Zero-Day
    Threat Intel

    When One HTTP Request Is All It Takes: The ShinyHunters PeopleSoft Campaign

    SecTower Threat Intelligence
    July 16, 2026
    6 min read

    SecTower Threat Advisory

    Enterprise resource planning software has long been considered too obscure, too internal, and too complicated to be a mass-exploitation target. The ShinyHunters campaign against Oracle PeopleSoft put that assumption to rest. In roughly two weeks, a single unauthenticated request over HTTP became the entry point for a data-theft and extortion campaign that reached more than a hundred organizations before a patch even existed.

    If your organization runs PeopleSoft, or depends on a vendor that does, this one deserves your attention. Here is what happened, why it matters, and what to do about it.

    What happened

    Between May 27 and June 9, 2026, the data-extortion group ShinyHunters (tracked by Google's Mandiant as UNC6240) exploited a critical zero-day in Oracle PeopleSoft Enterprise PeopleTools. Oracle did not publish its advisory until June 10, which means the flaw was a live zero-day for every single victim across the entire exploitation window.

    The vulnerability, CVE-2026-35273, carries a CVSS score of 9.8 out of 10. It lives in the Updates Environment Management component of PeopleTools, the piece behind the Environment Management Hub (PSEMHUB), and affects versions 8.61 and 8.62 along with older unsupported releases. What makes it so dangerous is the low bar to exploit it: no authentication, no user interaction, just network access over HTTP to reach the vulnerable endpoint and execute code at the server level.

    Mandiant identified more than a hundred exposed organizations, most in the United States, and roughly two-thirds of them colleges and universities. ShinyHunters itself claimed to have compromised around 300 instances. Stolen data began appearing on the group's leak site on June 9. The University of Nottingham was among the confirmed victims, with a significant volume of student records exposed.

    Why education was hit so hard

    The heavy concentration in higher education was not an accident. Universities tend to run sprawling, decentralized PeopleSoft deployments, often one per campus, department, or affiliated institution, and they frequently leave administrative portals reachable from the open internet to serve remote students and staff. PeopleSoft's Campus Solutions module is the backbone of enrollment, financial aid, and student records at many large universities. That combination of wide exposure and sensitive data makes higher education a target-rich environment for the kind of automated mass exploitation ShinyHunters specializes in.

    How the attack worked

    This campaign is notable less for a single clever exploit than for its industrialization. ShinyHunters historically relies on social engineering, voice phishing help desks and abusing single sign-on to reach SaaS data. Here they took a different route, and they automated nearly all of it.

    Researchers who analyzed exposed attacker infrastructure described a "gadget chain," a sequence stitching older, already-known PeopleSoft weaknesses together with the new zero-day to achieve full remote code execution. The underlying flaw has been characterized as a server-side request forgery that serves as the mechanism through which code execution is reached. Two endpoints were central to exploitation: /PSEMHUB/hub and /PSIGW/HttpListeningConnector.

    Once inside, the pattern was consistent. The attackers deployed customized builds of MeshCentral, an open-source remote management platform, disguised as legitimate Microsoft Azure services, with command-and-control traffic directed to a lookalike domain built to blend into cloud noise. They extracted credentials from the PeopleSoft application server configuration file, mapped connected nodes, and sprayed those credentials over SSH to move laterally across the environment. Data was compressed and staged for exfiltration. On compromised systems, they left a taunting marker file announcing the breach. The manual effort was reserved almost entirely for the extortion outreach, not the intrusion itself.

    That industrialization is the real lesson. This was not a hand-crafted attack against one high-value target. It was a repeatable process pointed at an entire class of internet-exposed systems.

    What this means for defenders

    A few takeaways stand out.

    Patching alone is not the finish line. Because exploitation predated the patch by two weeks, any organization that ran an exposed instance during that window may already have been compromised, even after applying Oracle's fix. Patching closes the door; it does not tell you whether someone already walked through it.

    Piecemeal patching leaves gaps. The gadget-chain approach means organizations that patched individual PeopleSoft weaknesses over the years may still be exposed if they missed any link in the chain. A single up-to-date CVE is not the same as a hardened, fully-patched estate.

    Your exposure may be someone else's PeopleSoft. PeopleSoft holds payroll, financial, and personal records, exactly the data extortion crews want. If a vendor in your supply chain runs an exposed instance, their breach can become your incident. This is a moment to confirm patch status and exposure with critical vendors rather than wait for a scheduled assessment cycle.

    Recommended actions

    If you run Oracle PeopleSoft, we recommend the following on an emergency basis.

    Apply Oracle's update for your PeopleTools version as soon as you confirm availability through My Oracle Support. For releases older than 8.61, no patch exists; the path forward is upgrading to a supported version.

    Reduce the attack surface. In multi-server configurations, disable the Environment Management Hub service. In single-server configurations, remove the PSEMHUB application entirely, following Oracle's guidance. If neither is possible immediately, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter or firewall. Restricting these endpoints does not break standard end-user browser sessions. Note that web application firewall body-inspection rules alone are not sufficient here, as they can be bypassed; network-layer restriction is the stronger control.

    Investigate for prior compromise, do not just patch and move on. Because the exploitation window predates the advisory, hunt for evidence of intrusion even after patching. Rotate any credentials that may have been exposed, particularly those stored in application server configuration files, and look for signs of lateral movement toward other servers in the PeopleSoft environment.

    Hunt for known indicators. Look for unexpected files under the PSEMHUB web application directory, outbound SMB connections on port 445 from PeopleSoft hosts to external destinations, connections to known staging infrastructure, and the attacker's defacement marker file. Monitor outbound traffic for contact with the campaign's command-and-control infrastructure.

    How SecTower can help

    Our detection engineering team has built a full set of hunting content mapped to this campaign, including SIEM detections for the exploitation endpoints, network-traffic and DNS hunts for the campaign's command-and-control infrastructure, host-based detections for the deployed tooling and persistence, and an indicator-of-compromise lookup with source-verified provenance so your team knows exactly which indicators are confirmed against primary reporting and which need further validation before they drive blocking.

    If you run PeopleSoft, or you are responsible for vendors who do, and you want help confirming your exposure, hunting for prior compromise, or operationalizing detections for this campaign, reach out to the SecTower team. The window between disclosure and exploitation is closing faster every year. The organizations that fared best in this campaign were the ones already watching.

    References

    This advisory is provided for informational purposes and reflects the threat landscape as of publication. Indicators and guidance evolve; consult the linked primary sources for the latest details.