Ethical Hacking News
A critical zero-day flaw in Oracle PeopleSoft has been exploited by attackers to gain unauthorized access to internal management interfaces. The flaw, identified as CVE-2026-35273, is a three-headed threat that allows attackers to reach an internal management interface by exploiting a server-side request forgery (SSRF) vulnerability. Organizations are advised to apply the patch and take additional measures to secure their systems to mitigate the impact of this vulnerability.
Oracle PeopleSoft Zero-Day Flaw (CVE-2026-35273) has been exploited by attackers to gain unauthorized access to internal management interfaces. The flaw is a three-headed threat, leveraging three distinct vulnerabilities in two PeopleSoft components. The vulnerabilities allow attackers to bypass trust checks, control system files, and run malicious code without a web shell. The design decision allowing loopback access by default makes the trust check ineffective and has been exploited by attackers. ShinyHunters group has been linked to a series of high-profile attacks, including exploitation of the Plex2Shell flaw. Organizations are advised to apply the patch and take additional measures to secure their systems to mitigate the impact of this vulnerability.
Oracle PeopleSoft Zero-Day Flaw: A Three-Headed Threat
The world of cybersecurity has witnessed its fair share of high-stakes vulnerabilities, but the recent exploitation of a zero-day flaw in Oracle PeopleSoft has sent shockwaves throughout the industry. The flaw, identified as CVE-2026-35273, has been attributed to a three-headed threat, with attackers leveraging three distinct vulnerabilities across two PeopleSoft components to gain unauthorized access to internal management interfaces.
According to Bobby Gould of the Zero Day Initiative (ZDI), the three vulnerabilities are not independent of each other, but rather form a chain of events that culminates in a single, devastating impact. The first vulnerability, identified as a server-side request forgery (SSRF), allows an attacker to reach an internal management interface by exploiting the default loopback address. This is made possible because Oracle PeopleSoft trusts its own loopback address by default, allowing an attacker to bypass the trust check and gain access to the internal interface.
The second vulnerability is a PSEMHUB command that abuses a write log entry command, allowing the attacker to control both the file contents and the exact path on disk. This vulnerability is particularly concerning because it allows the attacker to write a web shell into the application directory, thereby gaining full control over the system. The third vulnerability is a malicious XML file that PSEMHUB reads using Java's XMLDecoder, which runs the attacker's code without the need for planting a web shell.
The design decision at the center of this flaw is that allowing loopback access by default makes the trust check ineffective once the SSRF exists. This is a critical flaw that has been exploited by attackers, who have been able to slip past web application firewall (WAF) rules that would have blocked the SSRF. In fact, Mandiant has reported that ShinyHunters, a group that has been tracking the attacks, has exploited this flaw in over 1,200 systems worldwide, mostly in the education sector.
The good news is that Oracle has released a patch for this flaw, which is now available under the identifier CVE-2026-35273. However, the patch is only available for PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, and organizations that are not running these versions are still at risk.
In light of this vulnerability, Oracle recommends that organizations apply the patch as soon as possible, and those who cannot patch yet should consider disabling the Environment Management Hub service in multi-server setups or removing the PSEMHUB application in single-server setups. Additionally, organizations that have already been compromised should treat any host with a web shell as compromised, preserve evidence, and rotate every credential reachable from the PeopleSoft tier.
The ShinyHunters group has been linked to a series of high-profile attacks, including the exploitation of the Plex2Shell flaw, which allowed attackers to install crypto miners and Linux proxy backdoors on compromised systems. The group's tactics are often sophisticated and targeted, making them a force to be reckoned with in the world of cybercrime.
In conclusion, the Oracle PeopleSoft zero-day flaw is a three-headed threat that has been exploited by attackers to gain unauthorized access to internal management interfaces. The flaw is not limited to the education sector, and organizations of all sizes are at risk. By applying the patch and taking additional measures to secure their systems, organizations can mitigate the impact of this vulnerability and protect themselves against future attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/ShinyHunters-Three-Headed-Threat-Unpacking-the-Oracle-PeopleSoft-Zero-Day-Flaw-ehn.shtml
https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
https://nvd.nist.gov/vuln/detail/CVE-2026-35273
https://www.cvedetails.com/cve/CVE-2026-35273/
Published: Wed Oct 28 03:36:28 2026 by llama3.2 3B Q4_K_M
