{"slug":"oracle-peoplesoft-cve-2026-35273","title":"Oracle PeopleSoft PeopleTools (CVE-2026-35273)","shortName":"PeopleSoft","summary":"Unauthenticated SSRF-to-RCE chain in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Updates Environment Management). Oracle CVSS 3.1 9.8. CISA KEV 12 Jun 2026 (ransomware use Known). Mandiant/GTIG attributes in-the-wild use to UNC6240 (ShinyHunters) from 27 May to 9 Jun 2026 as a zero-day, then a wider September wave. ZDI (27 Oct 2026) says one CVE covers three bugs. No public PoC is indexed here.","isExample":false,"draft":false,"family":"oracle-peoplesoft-cve-2026-35273","kind":"single-product","aliases":["CVE-2026-35273","PeopleSoft PeopleTools","PSEMHUB","PSIGW"],"publishedAt":"2026-10-29","updatedAt":"2026-10-29","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-35273","cvss":{"cve":"CVE-2026-35273","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35273","sourceDate":"2026-06-10","checkedDate":"2026-10-29","dateLabel":"Oracle alert","nvdPublishedDate":"2026-06-11"},"epss":{"cve":"CVE-2026-35273","score":0.96678,"percentile":0.99884,"date":"2026-10-28","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35273","checkedDate":"2026-10-29"},"kev":{"cve":"CVE-2026-35273","listed":true,"dateAdded":"2026-06-12","dueDate":"2026-06-15","catalogVersion":"2026.10.28","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-29"},"addedDate":"2026-10-29"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated RCE in PeopleSoft PeopleTools 8.61 and 8.62 (CVE-2026-35273, Oracle CVSS 9.8). CISA KEV 12 Jun 2026, ransomware use Known. Mandiant/GTIG: UNC6240 (ShinyHunters) exploited it as a zero-day from 27 May to 9 Jun 2026, then again in September across more sectors.","action":"Apply the CVE-2026-35273 Security Alert patch (Patch Availability Document on My Oracle Support). If you cannot patch, disable Environment Management Hub in multi-server setups or remove the PSEMHUB application in single-server setups. Path-based WAF blocking is not a substitute. Hunt web shells and rotate credentials reachable from the PeopleSoft tier."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-06-12","method":"CISA KEV catalog 2026.10.28, dateAdded 2026-06-12, due 2026-06-15, knownRansomwareCampaignUse Known, CWE-306. Checked 29 Oct 2026.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"compromised","value":"Web shells on dozens of systems","observer":"Mandiant / GTIG","date":"2026-09-25","method":"Mandiant/GTIG 25 Sep 2026: UNC6240 deployed web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation, and government.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"},{"metric":"third-party-stated","value":"Over 100 organizations notified","observer":"Mandiant / GTIG","date":"2026-06-11","method":"Mandiant/GTIG 11 Jun 2026: notified over 100 organizations whose IPs correlated with potentially vulnerable endpoints; 68 percent higher education. Some later appeared on the ShinyHunters DLS (9 Jun 2026). Not a count of confirmed breaches.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-29","items":[{"text":"New catalog page for Oracle PeopleSoft PeopleTools CVE-2026-35273 (KEV; UNC6240 / ShinyHunters).","headline":"New catalog page for Oracle PeopleSoft CVE-2026-35273","section":"overview","date":"2026-10-29","kind":"page"},{"text":"ZDI 27 Oct 2026 analysis: Oracle's one CVE covers three bugs (PSIGW HttpListeningConnector SSRF; PSEMHUB validateClient trusts 127.0.0.1 by default; file-write web shell or XMLDecoder on restart). ZDI is coordinating separate CVEs; none assigned as of 28 Oct 2026 (THN).","headline":"ZDI 27 Oct analysis: one CVE covers three bugs","section":"overview","date":"2026-10-29","sourceUrl":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","alsoSourceUrl":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html"}]},"whatTheBugIs":"CVE-2026-35273 is Oracle's identifier for a remotely exploitable, unauthenticated issue in PeopleSoft Enterprise PeopleTools, component Updates Environment Management, protocol HTTP. Oracle Security Alert Rev 1 (10 Jun 2026) names supported versions 8.61 and 8.62, scores CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and says successful exploitation may result in remote code execution. Oracle also says PeopleSoft Enterprise Applications customers may be affected, and that earlier unsupported versions of affected releases are likely affected. Credits: Bobby Gould and Minh Giang (TrendAI Zero Day Initiative) and Lucas Miller (TrendAI Research). NVD republishes the Oracle CNA metric as type Secondary (checked 29 Oct 2026); NVD has no NVD-produced CVSS.\n\nZDI (Bobby Gould, 27 Oct 2026) says that single CVE covers three distinct bugs. PeopleSoft Integration Gateway (PSIGW) HttpListeningConnector can be used as server-side request forgery: an unauthenticated caller can make the gateway send a request of its choosing. PeopleSoft Environment Management Hub (PSEMHUB) gates access with validateClient, which reads allowedhosts.properties. That file ships with localhost / 127.0.0.1 allowed, so a loopback request from PSIGW satisfies the check. From there ZDI describes two code-execution paths: an attacker-controlled file write that can drop a web shell under the PSEMHUB web application, or a planted XML file under envmetadata/data/environment/ that Java XMLDecoder reads when PSEMHUB starts (for example after a service restart). ZDI is coordinating with Oracle for separate CVEs. The Hacker News (28 Oct 2026) says none had been assigned as of that week. This page does not republish request bodies or payloads from the ZDI post.\n\nMandiant and Google Threat Intelligence Group (11 Jun 2026) attribute a campaign to UNC6240 (ShinyHunters) between 27 May 2026 and 9 Jun 2026, before Oracle's 10 Jun fix, so the first wave was zero-day. Targeting in that wave was concentrated in higher education. A 25 Sep 2026 follow-up describes a later wave that reached PSEMHUB by requesting /%50SEMHUB/ instead of /PSEMHUB/, which bypasses WAF rules that match the literal path before URL decoding. Mandiant says path-based WAF blocking is not a substitute for patching.\n\nCISA added CVE-2026-35273 to KEV on 12 Jun 2026 (due 15 Jun 2026). The catalog name is Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability. CWE-306. knownRansomwareCampaignUse Known. Checked 29 Oct 2026 against catalog 2026.10.28. Trend Micro (Jacob Santos, 18 Jun 2026) notes that XMLDecoder and JSP execution inside the WebLogic JVM can produce no child-process telemetry unless a web shell then runs an operating-system command. The same 18 Jun post says the chain affected PeopleTools 8.61 and 8.62, including installations that were fully patched before the out-of-band advisory, because Oracle's prior serialization-filter hardening does not cover this XMLDecoder code path.","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads.","steps":[{"id":"internet","label":"Internet","detail":"Unauthenticated HTTP reachability to PeopleSoft Integration Gateway."},{"id":"app","label":"PSIGW SSRF","detail":"HttpListeningConnector forwards a caller-chosen request (ZDI, 27 Oct 2026)."},{"id":"unsafe","label":"PSEMHUB trusts loopback","detail":"validateClient allows 127.0.0.1 by default via allowedhosts.properties."},{"id":"exec","label":"Web shell or XMLDecoder","detail":"File write to a JSP, or XML read by XMLDecoder on service start."},{"id":"shell","label":"Theft and extortion","detail":"Code runs as the PeopleSoft service account. UNC6240 steals data and extorts."}]},"exploitation":{"kev":{"listed":true,"date":"2026-06-12","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV catalog 2026.10.28 (released 2026-10-28T19:00:04.8077Z, 1,762 entries). CVE-2026-35273 added 2026-06-12, due 2026-06-15. vulnerabilityName: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability. CWE-306. knownRansomwareCampaignUse Known. Checked 29 Oct 2026."},"firstSeen":{"date":"2026-05-27","source":"Mandiant / GTIG (11 Jun 2026)","note":"Mandiant/GTIG: activity observed 27 May 2026 to 9 Jun 2026, consistent with CVE-2026-35273, predating Oracle's 10 Jun 2026 advisory. First calendar day of any earlier use: not verified."},"vendorStatements":[{"vendor":"Oracle","date":"2026-06-10","statement":"This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution.","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","retracted":false},{"vendor":"CISA","date":"2026-06-12","statement":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Date added 12 Jun 2026. Due 15 Jun 2026. knownRansomwareCampaignUse Known. CWE-306.","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","retracted":false},{"vendor":"Mandiant / GTIG","date":"2026-06-11","statement":"Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints. Because this activity predates Oracle's June 10, 2026 advisory, the vulnerability was exploited as a zero-day.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","retracted":false},{"vendor":"Mandiant / GTIG","date":"2026-09-25","statement":"Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","retracted":false}]},"timeline":[{"date":"2026-05-27","event":"Mandiant/GTIG: UNC6240 (ShinyHunters) activity consistent with CVE-2026-35273 begins. Staging hosts installed MeshCentral 1.1.59 at 22:14 UTC. Zero-day relative to Oracle's 10 Jun advisory.","source":{"title":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","publisher":"Mandiant / GTIG"},"kind":"exploited","key":true,"addedDate":"2026-10-29"},{"date":"2026-06-09","event":"Mandiant/GTIG: first-wave activity through 9 Jun 2026. Stolen data published on the ShinyHunters data leak site the same day. Open attacker staging directories reported publicly.","source":{"title":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","publisher":"Mandiant / GTIG"},"kind":"exploited","key":true,"addedDate":"2026-10-29"},{"date":"2026-06-10","event":"Oracle published Security Alert CVE-2026-35273 Rev 1. PeopleTools 8.61 and 8.62. Unauthenticated HTTP. CVSS 3.1 9.8. May result in RCE. Credits: Bobby Gould, Minh Giang, Lucas Miller.","source":{"title":"Oracle Security Alert Advisory - CVE-2026-35273","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","publisher":"Oracle"},"kind":"advisory","key":true,"addedDate":"2026-10-29"},{"date":"2026-06-10","event":"ZDI says TrendAI Zero Day Initiative first reported the issue to Oracle on 10 Jun 2026 (same calendar day as the alert).","source":{"title":"CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft","url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","publisher":"TrendAI Zero Day Initiative"},"kind":"disclosure","addedDate":"2026-10-29"},{"date":"2026-06-11","event":"Mandiant/GTIG published the first campaign write-up. Notified over 100 organizations; 68 percent higher education. NVD published CVE-2026-35273 at 04:16 UTC.","source":{"title":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","publisher":"Mandiant / GTIG"},"kind":"exploited","addedDate":"2026-10-29"},{"date":"2026-06-11T04:16:53.680Z","event":"NVD published CVE-2026-35273. Status when we opened the record on 29 Oct 2026: Analyzed. Oracle CNA CVSS 3.1 9.8 listed as type Secondary. Last modified 23 Jul 2026. NVD has no NVD-produced CVSS.","source":{"title":"NVD - CVE-2026-35273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35273","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-29"},{"date":"2026-06-12","event":"CISA added CVE-2026-35273 to KEV. Due 15 Jun 2026. knownRansomwareCampaignUse Known. CWE-306. Rapid7 published an early-threat note the same day.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-29"},{"date":"2026-06-12","event":"Kudelski Security published a defender summary of the UNC6240 campaign and the same Mandiant-attributed indicators.","source":{"title":"Active Exploitation of Oracle PeopleSoft Environment Management","url":"https://kudelskisecurity.com/research/active-exploitation-of-oracle-peoplesoft-environment-management","publisher":"Kudelski Security"},"kind":"advisory","addedDate":"2026-10-29"},{"date":"2026-06-18","event":"Trend Micro published a technical analysis: XMLDecoder and JSP execution inside the WebLogic JVM can produce no child-process telemetry. Named Deep Discovery, TippingPoint, and Deep Security rule IDs.","source":{"title":"PeopleSoft PeopleTools Pre-Authentication RCE","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","publisher":"Trend Micro"},"kind":"advisory","addedDate":"2026-10-29"},{"date":"2026-09-25","event":"Mandiant/GTIG: renewed mass exploitation. WAF bypass via /%50SEMHUB/. Web shells on dozens of systems across more sectors. Path-based WAF blocking is not a substitute for patching.","source":{"title":"ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","publisher":"Mandiant / GTIG"},"kind":"exploited","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-27","event":"ZDI (Bobby Gould) published the SSRF-to-RCE chain: three bugs under one CVE. Coordinating separate CVEs with Oracle. This is technical analysis, not a public PoC.","source":{"title":"CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft","url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","publisher":"TrendAI Zero Day Initiative"},"kind":"disclosure","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-28","event":"The Hacker News: ZDI says one CVE is three chained flaws; separate CVEs not assigned as of that week. The Register covered the same ZDI breakdown.","source":{"title":"ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws","url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-10-29"}],"openNotes":[{"title":"One CVE, three ZDI bugs; separate CVEs not assigned","detail":"ZDI (27 Oct 2026) reported three distinct issues (ZDI-CAN-31816 SSRF, ZDI-CAN-31818 file-path write, ZDI-CAN-31817 XMLDecoder) and says it is coordinating with Oracle for separate CVEs. The Hacker News (28 Oct 2026) says the June identifier was still the only one on the record as of that week. Independent assignment of extra CVEs: not verified.","sources":[{"url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","date":"2026-10-27","publisher":"TrendAI Zero Day Initiative"},{"url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","date":"2026-10-28","publisher":"The Hacker News"}]},{"title":"Oracle public alert does not reprint the workaround text","detail":"The public Security Alert HTML (Rev 1, 10 Jun 2026) points to a Patch Availability Document for mitigation and installation instructions. That document sits on My Oracle Support (login). Mandiant (11 Jun and 25 Sep 2026) and The Hacker News (28 Oct 2026) attribute the disable-EMHub / remove-PSEMHUB workaround to Oracle's alert guidance. The public HTML we opened does not reprint that wording. PAD build numbers: no statement yet.","sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"},{"url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","date":"2026-10-28","publisher":"The Hacker News"}]},{"title":"CWE labels differ across sources","detail":"CISA KEV and the NVD CISA Coordinator weakness list CWE-306 (missing authentication for a critical function). Rapid7 (12 Jun 2026) says TrendAI detection signatures classify the underlying flaw as SSRF (CWE-918). ZDI describes three bugs. This page does not resolve the labels.","sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-06-12","publisher":"CISA"},{"url":"https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/","date":"2026-06-12","publisher":"Rapid7"},{"url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","date":"2026-10-27","publisher":"TrendAI Zero Day Initiative"}]}],"defenderActions":[{"title":"Apply the CVE-2026-35273 Security Alert patch","detail":"Oracle: apply the Security Alert for PeopleTools 8.61 and 8.62. The public alert gives no build numbers. Use the Patch Availability Document on My Oracle Support. Mandiant (25 Sep 2026): WAF rules and path-based blocking are not a substitute for patching.","priority":"now","links":[{"label":"Oracle Security Alert CVE-2026-35273","href":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html"}]},{"title":"If you cannot patch, disable EMHub or remove PSEMHUB","detail":"Mandiant (25 Sep 2026), citing Oracle alert guidance: disable the Environment Management Hub service in multi-server configurations, or remove the PSEMHUB application in single-server configurations. The public Oracle HTML does not reprint that text.","priority":"now","links":[{"label":"Mandiant 25 Sep 2026","href":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"}]},{"title":"Hunt web shells and rotate credentials on exposed hosts","detail":"Mandiant (25 Sep 2026): treat a host with a web shell as compromised, preserve evidence, and rotate credentials reachable from the PeopleSoft tier. Check all WebLogic nodes, not only the first one identified.","priority":"now","links":[{"label":"Mandiant 25 Sep 2026","href":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"}]}],"detection":[{"title":"Internet requests to /PSIGW/HttpListeningConnector","detail":"Mandiant (11 Jun and 25 Sep 2026) and Trend Micro (18 Jun 2026): hunt PIA WebLogic, WAF, or proxy logs for requests to /PSIGW/HttpListeningConnector from external source IPs. Presence of a request is reachability or probing, not proof of code execution. This page does not copy request bodies.","logSource":"Web / WAF / reverse-proxy / PIA WebLogic access logs","kind":"generic","group":"web-proxy","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","date":"2026-06-11"},{"title":"Requests to /PSEMHUB/ and percent-encoded variants","detail":"Mandiant 25 Sep 2026: search access logs for /PSEMHUB/ and any percent-encoded variant (for example /%50SEMHUB/), especially POST to /hub and requests to unexpected .jsp files from external IPs. Mandiant: assume mixed-case or otherwise non-normalized variants, and enforce blocking on the normalized path.","logSource":"Web / WAF / reverse-proxy / PIA WebLogic access logs","kind":"generic","group":"waf-ips","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25"},{"title":"New JSP files in PeopleSoft web application directories","detail":"Mandiant 25 Sep 2026: inspect PSEMHUB.war and PORTAL.war for files that are not part of the shipped product, including x.jsp, u.jsp, tunnel.jsp, tunnel.jspx, and Ple64.exe. Check every node behind a load balancer.","logSource":"Host filesystem / FIM on PeopleSoft web-tier directories","kind":"generic","group":"edr","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25"},{"title":"Unexpected XML under PSEMHUB envmetadata","detail":"ZDI (27 Oct 2026) and Mandiant (11 Jun 2026): recently created or modified .xml files under envmetadata/data/environment/ may be read by XMLDecoder at PSEMHUB start. Also review envmetadata/transactions/ for unauthorized content. Trend Micro (18 Jun 2026): allow-list PeopleSoft Change Assistant and Veritas NetBackup, which write these paths in normal operation.","logSource":"Host filesystem / FIM on PSEMHUB envmetadata directories","kind":"generic","group":"edr","url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","date":"2026-10-27"},{"title":"WebLogic Java spawning a shell","detail":"Mandiant 25 Sep 2026: alert on cmd.exe, /bin/sh, or bash spawned by the WebLogic Java process, especially those invoking base64 -d, curl, /dev/tcp, tasklist, or start /b. Trend Micro (18 Jun 2026): in-JVM XMLDecoder or JSP execution can produce no child-process telemetry unless a shell command then runs. Absence of a spawn is no statement yet, not clearance.","logSource":"EDR / process telemetry on PeopleSoft WebLogic hosts","kind":"generic","group":"edr","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25"},{"title":"Trend Micro Deep Discovery 5855 / 5863","detail":"Trend Micro (18 Jun 2026): Deep Discovery rule 5855 PeopleSoft PeopleTools Environment Management Hub (PSEMHUB) SSRF Exploit HTTP Request; rule 5863 Oracle PeopleSoft HubMBeanPersistance Deserialization of Untrusted Data RCE Exploit HTTP Request.","logSource":"Trend Micro Deep Discovery event logs","kind":"vendor-signature","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18"},{"title":"Trend Micro TippingPoint 47502 / 47529 / 47545","detail":"Trend Micro (18 Jun 2026): TippingPoint filter 47502 CVE-2026-35273 HTTP Oracle PeopleSoft Server-Side Request Forgery; filter 47529 ZDI-CAN-31817; filter 47545 ZDI-CAN-31818.","logSource":"Trend Micro TippingPoint SMS event logs","kind":"vendor-signature","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18"},{"title":"Trend Micro Deep Security / Vision One 1012580 / 1012585","detail":"Trend Micro (18 Jun 2026): Deep Security, Vision One Server and Workload Protection, and Endpoint Security IPS filter 1012580 Oracle PeopleSoft PeopleTools SSRF Vulnerability (CVE-2026-35273); filter 1012585 Oracle PeopleSoft Untrusted Data Deserialization Vulnerability (ZDI-CAN-31817).","logSource":"Trend Micro Deep Security / Vision One IPS event logs","kind":"vendor-signature","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18"},{"title":"Google Security Operations Mandiant Frontline Threats (PeopleSoft)","detail":"Mandiant 25 Sep 2026 names Google SecOps rules under the Mandiant Frontline Threats pack: Oracle PeopleSoft Configuration Inspection; Sshpass Interactive File Deployment; Data Archiving or Compression via Zstd Utility; MeshCentral Command Execution via Meshctrl; and pending Oracle PeopleSoft Suspicious File Write to Web Application Archive Directory. Query text is not public. Customer-only.","logSource":"Google Security Operations curated detections","kind":"vendor-signature","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25"}],"detectionRules":[{"id":"v2s-sigma-peoplesoft-psemhub-path","title":"PeopleSoft PSEMHUB or PSIGW path from the internet","language":"sigma","query":"title: PeopleSoft PSEMHUB or PSIGW path (CVE-2026-35273)\nid: 3e8c1b70-6a2d-4f09-9e11-2c7d4a8f0b22\nstatus: experimental\ndescription: Web requests to PeopleSoft Integration Gateway HttpListeningConnector or Environment Management Hub paths that Mandiant named for CVE-2026-35273, including a percent-encoded PSEMHUB variant.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35273\nauthor: vuln2shell\ndate: 2026/10/29\nlogsource:\n    category: webserver\ndetection:\n    selection_path:\n        cs-uri-stem|contains:\n            - '/PSIGW/HttpListeningConnector'\n            - '/PSEMHUB/'\n            - '/%50SEMHUB/'\n            - '/%50semhub/'\n    condition: selection_path\nfalsepositives:\n    - Internal Integration Broker east-west traffic to PSIGW (Trend Micro, 18 Jun 2026)\n    - Legitimate Change Assistant or operations traffic to PSEMHUB from trusted hosts\nlevel: medium","logSource":"Web / WAF / reverse-proxy / PIA WebLogic access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting rule from Mandiant-published paths. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/, and enforce blocking on the normalized path. The path alone is not proof of exploitation. Internal PSIGW traffic can be normal. Does not include request bodies. Tune field names to your parser.","tested":"untested"},{"id":"v2s-spl-peoplesoft-psemhub-path","title":"PeopleSoft PSEMHUB or PSIGW path (SPL)","language":"spl","query":"index=web sourcetype=access_combined\n(uri_path=\"*/PSIGW/HttpListeningConnector*\" OR uri_path=\"*/PSEMHUB/*\" OR uri_path=\"*/%50SEMHUB/*\" OR uri_path=\"*/%50semhub/*\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src values(method) as method by uri_path, host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web / WAF / reverse-proxy / PIA WebLogic access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from Mandiant-published paths, including the percent-encoded WAF-bypass variant. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/. Tune sourcetype and field names. Internal PSIGW traffic can be normal.","tested":"untested"},{"id":"v2s-kql-peoplesoft-psemhub-path","title":"PeopleSoft PSEMHUB or PSIGW path (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csUriStem has \"/PSIGW/HttpListeningConnector\" or csUriStem has \"/PSEMHUB/\" or csUriStem has \"/%50SEMHUB/\" or csUriStem has \"/%50semhub/\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, csMethod\n| order by count_ desc","logSource":"IIS / web access logs shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Table name varies. Map W3CIISLog to your WebLogic or proxy parser if those hosts are not IIS. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/.","tested":"untested"},{"id":"v2s-esql-peoplesoft-psemhub-path","title":"PeopleSoft PSEMHUB or PSIGW path (ES|QL)","language":"esql","query":"FROM logs-web.*\n| WHERE @timestamp > NOW() - 14 days\n| WHERE url.path LIKE \"*\\/PSIGW\\/HttpListeningConnector*\" OR url.path LIKE \"*\\/PSEMHUB\\/*\" OR url.path LIKE \"*\\/%50SEMHUB\\/*\" OR url.path LIKE \"*\\/%50semhub\\/*\"\n| STATS count = COUNT(*) BY host.name, source.ip, url.path, http.request.method\n| SORT count DESC","logSource":"Web access logs in Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Index and field names vary by integration. Hunting only. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/.","tested":"untested"},{"id":"v2s-suricata-peoplesoft-psemhub-path","title":"PeopleSoft PSEMHUB or PSIGW path (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"vuln2shell PeopleSoft PSEMHUB or PSIGW path\"; flow:established,to_server; http.uri; content:\"/PSIGW/HttpListeningConnector\"; nocase; sid:2026352731; rev:2;)\nalert http any any -> any any (msg:\"vuln2shell PeopleSoft PSEMHUB path\"; flow:established,to_server; http.uri; content:\"/PSEMHUB/\"; nocase; sid:2026352732; rev:2;)\nalert http any any -> any any (msg:\"vuln2shell PeopleSoft encoded PSEMHUB path\"; flow:established,to_server; http.uri.raw; content:\"/%50SEMHUB/\"; nocase; sid:2026352733; rev:2;)\nalert http any any -> any any (msg:\"vuln2shell PeopleSoft encoded PSEMHUB path lowercase p\"; flow:established,to_server; http.uri.raw; content:\"/%70SEMHUB/\"; nocase; sid:2026352734; rev:1;)","logSource":"Network IDS / Suricata HTTP logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Path only. No request body. Encoded rules use http.uri.raw because Suricata http.uri is the normalised buffer. %50 is Mandiant's published encoding of P; %70 is the matching encoding of p. nocase covers mixed-case of those literals. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/, and enforce blocking on the normalized path. Local sids; renumber to fit your range. Needs TLS termination or decryption to see the URI. Internal PSIGW traffic can be normal.","tested":"untested"},{"id":"v2s-yara-peoplesoft-mandiant-files","title":"Mandiant-published UNC6240 PeopleSoft filenames and hashes","language":"yara","query":"import \"hash\"\n\nrule v2s_peoplesoft_cve_2026_35273_mandiant\n{\n    meta:\n        author = \"vuln2shell\"\n        date = \"2026-10-29\"\n        description = \"Mandiant-published UNC6240 PeopleSoft artefact strings and durable SHA-256\"\n        source = \"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft\"\n    strings:\n        $readme = \"README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT\"\n        $ple64 = \"Ple64.exe\"\n        $ujsp = \"u.jsp\"\n        $u2jsp = \"u2.jsp\"\n        $tunnel = \"tunnel.jsp\"\n        $tunnelx = \"tunnel.jspx\"\n        $xjsp = \"x.jsp\"\n    condition:\n        3 of ($readme, $ple64, $ujsp, $u2jsp, $tunnel, $tunnelx, $xjsp) or\n        hash.sha256(0, filesize) == \"2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7\" or\n        hash.sha256(0, filesize) == \"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3\"\n}","logSource":"PeopleSoft web-tier filesystem (PSEMHUB.war / PORTAL.war)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Requires three Mandiant-sourced filename strings, or a durable published SHA-256 (u.jsp or Ple64.exe from Mandiant 25 Sep 2026). README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT is from Mandiant 11 Jun 2026. A lone x.jsp string does not match. Mandiant says x.jsp and tunnel hashes vary, so those hashes are omitted. Does not include web-shell source.","tested":"untested"}],"detectionLinks":[{"title":"ProjectDiscovery Nuclei scanner CVE-2026-35273","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml","author":"DhiyaneshDk","date":"2026-06-16","note":"First commit 16 Jun 2026 per GitHub history for http/cves/2026/CVE-2026-35273.yaml (checked 29 Oct 2026). Sends a Java deserialization check to /PSEMHUB/hub with a DNS callback. Do not run it against hosts you do not own. This site does not copy the request body. Not indexed as an RCE PoC."},{"title":"Trend Micro PeopleSoft PeopleTools Pre-Authentication RCE","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","author":"Jacob Santos, Trend Micro","date":"2026-06-18","note":"Named Deep Discovery, TippingPoint, and Deep Security rule IDs. Notes in-JVM execution can produce no child-process telemetry."}],"retrohunt":{"summary":"If PeopleSoft PeopleTools 8.61 or 8.62 was reachable on /PSIGW/HttpListeningConnector or /PSEMHUB/ (including /%50SEMHUB/), hunt from 27 May 2026 in web logs, web-tier files, and process telemetry. Mandiant observed zero-day use through 9 Jun 2026 and a later wave around 25 Sep 2026.","lookback":{"from":"2026-05-27","basis":"first-exploitation","rationale":"Mandiant/GTIG (11 Jun and 25 Sep 2026) dates the first observed UNC6240 wave from 27 May 2026 to 9 Jun 2026, before Oracle's 10 Jun advisory. Earlier use: not verified.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","date":"2026-06-11","publisher":"Mandiant / GTIG"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},"logSources":[{"name":"PIA WebLogic / WAF / proxy access logs","why":"Mandiant: POST /PSEMHUB/hub, POST /PSIGW/HttpListeningConnector, and percent-encoded /%50SEMHUB/ variants from external IPs.","required":true},{"name":"PeopleSoft web-tier filesystem","why":"Mandiant: unexpected JSP, JSPX, and EXE files under PSEMHUB.war and PORTAL.war; unauthorized envmetadata content.","required":true},{"name":"EDR / process telemetry on WebLogic hosts","why":"Mandiant: shells spawned by the WebLogic Java process. Trend Micro: in-JVM execution can leave no child process.","required":true},{"name":"Outbound firewall / NetFlow from PeopleSoft hosts","why":"Mandiant: outbound SMB/445, SSH, and HTTP to published network indicators; large archives.","required":false}],"steps":[{"title":"Search access logs for PSEMHUB, encoded PSEMHUB, and PSIGW from 27 May 2026","detail":"Hunt POST requests to /PSEMHUB/hub, /%50SEMHUB/hub, and /PSIGW/HttpListeningConnector from untrusted source IPs. Mandiant: hosts the actor validated but did not yet exploit may show only the encoded POST, with no follow-on files.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"title":"Inspect PSEMHUB.war and PORTAL.war on every WebLogic node","detail":"Mandiant 25 Sep 2026: look for files that are not part of the shipped product, including x.jsp, u.jsp, tunnel.jsp, tunnel.jspx, and Ple64.exe. Check all nodes behind a load balancer.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"title":"Review envmetadata and unexpected MeshCentral agents","detail":"Inspect envmetadata/transactions/ and envmetadata/data/environment/. Mandiant June also names unexpected directories logs, persistantstorage, or scratchpad (Mandiant spelling). On Linux, earlier waves dropped meshagent files under /tmp.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","date":"2026-06-11","publisher":"Mandiant / GTIG"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]}],"queries":[{"id":"v2s-rh-spl-peoplesoft-psemhub","title":"PeopleSoft PSEMHUB or PSIGW path since 27 May 2026","language":"spl","query":"index=web sourcetype=access_combined earliest=\"05/27/2026:00:00:00\"\n(uri_path=\"*/PSIGW/HttpListeningConnector*\" OR uri_path=\"*/PSEMHUB/*\" OR uri_path=\"*/%50SEMHUB/*\" OR uri_path=\"*/%50semhub/*\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src values(method) as method by uri_path, host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web / WAF / reverse-proxy / PIA WebLogic access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. A hit is reachability or probing, not proof of a web shell. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/.","tested":"untested","timeRange":"From 2026-05-27"},{"id":"v2s-rh-kql-peoplesoft-psemhub","title":"PeopleSoft PSEMHUB or PSIGW path since 27 May 2026 (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated >= datetime(2026-05-27)\n| where csUriStem has \"/PSIGW/HttpListeningConnector\" or csUriStem has \"/PSEMHUB/\" or csUriStem has \"/%50SEMHUB/\" or csUriStem has \"/%50semhub/\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, csMethod\n| order by count_ desc","logSource":"IIS / web access logs shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25","license":"CC0 1.0","origin":"vuln2shell","notes":"Map W3CIISLog to your WebLogic or proxy parser if those hosts are not IIS. Mandiant (25 Sep 2026): assume any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/.","tested":"untested","timeRange":"From 2026-05-27, limited by retention"}],"artefacts":[{"kind":"web-log","value":"POST /PSEMHUB/hub or /%50SEMHUB/hub from an external IP","detail":"Mandiant 25 Sep 2026. Encoded path is the published WAF-bypass variant. A request alone is not a web shell.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"web-log","value":"POST /PSIGW/HttpListeningConnector from an external IP","detail":"Mandiant 11 Jun and 25 Sep 2026. SSRF entry named by ZDI and Trend Micro.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"kind":"file","value":"<PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/x.jsp","detail":"Mandiant 25 Sep 2026 host indicator. Primary execution web shell filename.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"file","value":"<PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/Ple64.exe","detail":"Mandiant 25 Sep 2026: trojanized installer delivering SIDEEYE.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"file","value":"README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT","detail":"Mandiant 11 Jun 2026 defacement and extortion marker copied into WebLogic and Process Scheduler directories.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"kind":"process","value":"WebLogic Java spawning cmd.exe, /bin/sh, or bash","detail":"Mandiant 25 Sep 2026 fileless method. Trend Micro: in-JVM execution can produce no child process.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"}],"iocs":[{"type":"ip","value":"5.199.162.157","context":"Mandiant 25 Sep 2026: attack controller, scanner, and HTTP callback receiver","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"ip","value":"104.219.234.138","context":"Mandiant 25 Sep 2026: exfiltration staging and remote management host","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"ip","value":"162.219.30.165","context":"Mandiant 25 Sep 2026: C2 for SIDEEYE backdoor (TCP/3333 control, TCP/3334 data)","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"domain","value":"winmanage-me.network","context":"Mandiant 25 Sep 2026: resolves to 104.219.234.138; MeshCentral infrastructure","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"hash","value":"2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7","context":"Mandiant 25 Sep 2026 SHA-256 for u.jsp","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"hash","value":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","context":"Mandiant 25 Sep 2026 SHA-256 for Ple64.exe (SIDEEYE)","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"type":"ip","value":"142.11.200.186","context":"Mandiant 11 Jun 2026 staging host. GTIG triaged five sequential IPs hosting Python SimpleHTTP on port 8888.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"ip","value":"142.11.200.187","context":"Mandiant 11 Jun 2026 staging host. GTIG triaged five sequential IPs hosting Python SimpleHTTP on port 8888.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"ip","value":"142.11.200.188","context":"Mandiant 11 Jun 2026 staging host. GTIG triaged five sequential IPs hosting Python SimpleHTTP on port 8888.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"ip","value":"142.11.200.189","context":"Mandiant 11 Jun 2026 staging host. GTIG triaged five sequential IPs hosting Python SimpleHTTP on port 8888.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"ip","value":"142.11.200.190","context":"Mandiant 11 Jun 2026 staging host. GTIG triaged five sequential IPs hosting Python SimpleHTTP on port 8888.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"domain","value":"azurenetfiles.net","context":"Mandiant 11 Jun 2026 MeshCentral C2 masquerading as Azure NetApp Files (wss://azurenetfiles.net:443/agent.ashx). Later waves also used microsoft-entra.net and enroll.azuredevice.cloud (Mandiant 25 Sep 2026).","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"hash","value":"f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc","context":"Mandiant 11 Jun 2026 SHA-256 for meshagent64-azure-ops.exe","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"hash","value":"d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f","context":"Mandiant 11 Jun 2026 SHA-256 for meshagent64-v2.exe","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"hash","value":"c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f","context":"Mandiant 11 Jun 2026 SHA-256 for meshagent32-azure-ops.exe","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"type":"hash","value":"68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309","context":"Mandiant 11 Jun 2026 SHA-256 for unconfigured Linux meshagent","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"}],"iocNote":"Network and file indicators above are copied from Mandiant/GTIG 11 Jun 2026 and 25 Sep 2026 as written. x.jsp and tunnel.jsp / tunnel.jspx hashes are omitted because Mandiant says they vary. The [victim_abbreviation]_fanout.sh name is a Mandiant placeholder, not a matchable indicator. Mandiant also published a GTI collection for registered users; that extra set was not opened here. Do not invent IPs, hashes, or user-agents.","hitMeaning":[{"level":"attempt","detail":"External POST to /PSIGW/HttpListeningConnector, /PSEMHUB/hub, or /%50SEMHUB/hub, with no unexpected file under PSEMHUB.war and no shell spawn."},{"level":"likely-compromise","detail":"Unexpected XML under envmetadata/data/environment/, a WebLogic Java process spawning a shell after 27 May 2026, data staging (tar, zstd, rsync), or outbound connections to published C2. The staging and C2 bar is vuln2shell hunting guidance, not a Mandiant confirmed-compromise criterion."},{"level":"confirmed-compromise","detail":"Mandiant 25 Sep 2026: organizations that identify a web shell should treat the host as compromised.","label":"Compromise (Mandiant guidance)"}],"nextSteps":[{"title":"Apply the Security Alert patch and disable or remove EMHub if unused","detail":"Oracle patch plus Mandiant: disable EMHub in multi-server setups or remove PSEMHUB in single-server setups. Path-based WAF blocking is not a substitute.","links":[{"label":"Oracle Security Alert CVE-2026-35273","href":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html"},{"label":"Mandiant 25 Sep 2026","href":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"}]},{"title":"Preserve web-tier files and rotate credentials","detail":"Mandiant 25 Sep 2026: treat a host with a web shell as compromised, preserve evidence, and rotate credentials reachable from the PeopleSoft tier, including database strings in psappsrv.cfg, Integration Broker credentials, and cloud credentials on the web tier.","links":[{"label":"Mandiant 25 Sep 2026","href":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"}]}],"limits":["Trend Micro (18 Jun 2026): XMLDecoder and JSP execution inside the WebLogic JVM can produce no child-process telemetry.","Mandiant: a percent-encoded POST with no follow-on files can be target verification only.","PeopleSoft Change Assistant and Veritas NetBackup write envmetadata paths in normal operation (Trend Micro).","Mandiant GTI collection for registered users was not opened. Extra IOCs there: not verified.","First calendar day of any use before 27 May 2026: not verified."],"sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","date":"2026-06-11","publisher":"Mandiant / GTIG"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"},{"url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18","publisher":"Trend Micro"},{"url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","date":"2026-10-27","publisher":"TrendAI Zero Day Initiative"}],"updatedAt":"2026-10-29"},"amIAffected":{"summary":"Oracle's public alert names PeopleSoft Enterprise PeopleTools 8.61 and 8.62. PeopleSoft Enterprise Applications customers may also be affected. Earlier unsupported versions are likely affected. The public alert gives no build numbers. Record the installed PeopleTools version, whether PSEMHUB / EMHub is deployed, and whether /PSIGW/HttpListeningConnector or /PSEMHUB/ is reachable from untrusted networks.","checks":[{"id":"v2s-aia-oracle-peoplesoft-cve-2026-35273-version-1","kind":"version","title":"Record the PeopleTools version against the Security Alert table","detail":"Oracle Security Alert Rev 1 (10 Jun 2026): supported versions 8.61 and 8.62. No public CLI version string was copied from the alert in this pass. Use the product's own version display.","command":"Record the installed PeopleTools version from the product's own version display and compare it to Oracle's Security Alert table (affected: 8.61 and 8.62).","affectedMeans":"The installed PeopleTools version is 8.61 or 8.62, or an earlier unsupported release of those trains.","fixedMeans":"The host is on a supported 8.61 or 8.62 release and the CVE-2026-35273 Security Alert patch from the Patch Availability Document on My Oracle Support is applied.","notes":"This is inventory only. Oracle gives no public build numbers. Confirm the applied patch on My Oracle Support.","sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"}]},{"id":"v2s-aia-oracle-peoplesoft-cve-2026-35273-config-2","kind":"config","title":"Record whether EMHub / PSEMHUB is deployed","detail":"Mandiant, citing Oracle alert guidance: disable Environment Management Hub in multi-server setups, or remove the PSEMHUB application in single-server setups. On each web tier, record whether that application is present. Do not send crafted requests.","command":"On each PeopleSoft web-tier host, record whether the PSEMHUB application or Environment Management Hub service is deployed.","affectedMeans":"PSEMHUB / EMHub is deployed on a PeopleTools 8.61 or 8.62 host (or an earlier unsupported release).","fixedMeans":"PSEMHUB has been removed (single-server) or EMHub is disabled (multi-server), or the Security Alert patch is applied.","notes":"Presence of the application is inventory, not proof of compromise. The public Oracle HTML does not reprint the workaround text.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"id":"v2s-aia-oracle-peoplesoft-cve-2026-35273-exposure-3","kind":"exposure","title":"Scoped host search for PeopleSoft on your estate","detail":"ProjectDiscovery Nuclei metadata (scanner first commit 16 Jun 2026, checked 29 Oct 2026) lists Shodan query http.html:\"PeopleSoft\". Scope it to your ranges. This is a product fingerprint, not a CVE-specific detector. Do not send crafted requests.","command":"shodan search 'http.html:\"PeopleSoft\" net:<your-range>'","affectedMeans":"A host in your range presents a PeopleSoft HTTP body and you have not yet confirmed it is patched or that PSEMHUB / PSIGW listening connector is unreachable from untrusted networks.","fixedMeans":"No in-scope PeopleSoft hosts, or every in-scope host is patched and the listening connector / PSEMHUB paths are not reachable from untrusted networks.","notes":"Nuclei metadata also lists FOFA body=\"PeopleSoft Environment Management Hub\". Scanner first commit 16 Jun 2026 per GitHub history (checked 29 Oct 2026). First-listed date of the Shodan/FOFA metadata strings: not verified. Confirm reachability in your own inventory; do not probe strangers.","sources":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml","date":"2026-06-16","publisher":"ProjectDiscovery Nuclei (first commit)"}]},{"id":"v2s-aia-oracle-peoplesoft-cve-2026-35273-exposure-4","kind":"exposure","title":"Record whether PSIGW and PSEMHUB are reachable from untrusted networks","detail":"Mandiant: if you cannot disable EMHub, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector. Record reachability from untrusted networks. Include percent-encoded path variants. Do not send crafted requests.","command":"On each PeopleSoft web tier, record whether untrusted networks can reach /PSIGW/HttpListeningConnector or /PSEMHUB/ (including percent-encoded variants such as /%50SEMHUB/). Do not send crafted requests.","affectedMeans":"An untrusted network can complete HTTP to those paths on a PeopleTools 8.61 or 8.62 host that is not yet patched.","fixedMeans":"Those paths are not reachable from untrusted networks after URL decoding, or the Security Alert patch is applied and EMHub / PSEMHUB is disabled or removed.","notes":"Reachability is a precondition, not proof of compromise. Mandiant: path-based WAF matching before URL decode is not enough.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]}],"limits":["Oracle's public alert gives no build numbers. Confirm the applied patch on My Oracle Support.","No public PeopleTools CLI version string was copied from the Security Alert.","Trend Micro (Jacob Santos, 18 Jun 2026): the chain affected PeopleTools 8.61 and 8.62, including installations that were fully patched before the out-of-band advisory, because Oracle's prior serialization-filter hardening does not cover this XMLDecoder code path.","The Shodan fingerprint is Nuclei metadata, not a vendor detector.","Do not send crafted requests or scanner payloads against hosts you do not own."],"sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"},{"url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18","publisher":"Trend Micro"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"mitigations":{"summary":"Oracle released an out-of-band Security Alert patch. If you cannot patch yet, Mandiant and The Hacker News attribute a workaround to Oracle's alert guidance: disable Environment Management Hub in multi-server setups, or remove the PSEMHUB application in single-server setups. Path-based WAF blocking is not a substitute for patching.","items":[{"title":"Disable EMHub (multi-server) or remove PSEMHUB (single-server)","detail":"Mandiant 25 Sep 2026, citing Oracle's security alert guidance: disable the Environment Management Hub service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations. The Hacker News (28 Oct 2026) repeats the same workaround and says restricting these admin endpoints does not break normal user sessions.","limits":"The public Oracle HTML we opened does not reprint this wording; it points to the Patch Availability Document on My Oracle Support. Not a software fix. Re-enabling EMHub without the patch restores exposure. Confirm operational impact in your own change process.","verify":"PSEMHUB is not deployed on single-server hosts, or the EMHub service is stopped on multi-server hosts, and that state survives the next web-tier restart.","source":{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}},{"title":"Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector on the normalized path","detail":"Mandiant 11 Jun 2026: if you cannot disable EMHub, block external access to /PSEMHUB/* (specifically /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the network perimeter. Mandiant 25 Sep 2026: enforce blocking on the normalized path after URL decode. WAF rules that match the literal string /PSEMHUB before decoding miss /%50SEMHUB/.","limits":"Mandiant is explicit that WAF rules and path-based blocking are not a substitute for patching. Body-inspection rules alone were already called insufficient in June. Internal Integration Broker traffic to PSIGW can be normal (Trend Micro).","verify":"Untrusted networks cannot complete HTTP to /PSEMHUB/, /%50SEMHUB/, or /PSIGW/HttpListeningConnector after URL decoding. Confirm in the WAF or perimeter ACL, then re-check after the next rule change.","source":{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"response":{"summary":"Treat a host with a web shell as compromised. Preserve evidence, apply the Security Alert patch, disable or remove EMHub if unused, and rotate credentials reachable from the PeopleSoft tier. Patching closes the door; The Hacker News notes the sources do not settle whether it evicts access already gained.","containment":[{"title":"Treat a web-shell host as compromised and isolate it","detail":"Mandiant 25 Sep 2026: organizations that identify a web shell should treat the host as compromised. Check every WebLogic node behind a load balancer. Restrict untrusted access to /PSEMHUB/* and /PSIGW/HttpListeningConnector while you patch.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"title":"Apply the Security Alert patch","detail":"Oracle: apply the CVE-2026-35273 Security Alert on supported 8.61 and 8.62. An upgrade does not replace hunting if the host was reachable while vulnerable.","sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"}]},{"title":"Disable EMHub or remove PSEMHUB if you do not need it","detail":"Mandiant, citing Oracle guidance: disable EMHub in multi-server setups or remove PSEMHUB in single-server setups.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]}],"rotate":[{"item":"Database connection strings in psappsrv.cfg, Integration Broker credentials, and cloud credentials reachable from the web tier","reason":"Mandiant 25 Sep 2026: rotate credentials readable by the PeopleSoft application service account, including database connection strings in psappsrv.cfg, Integration Broker credentials, and any cloud credentials reachable from the web tier. Prioritize hosts where WebLogic runs as root or SYSTEM.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"item":"Other secrets the PeopleSoft host could reach","reason":"General: if unauthenticated code execution succeeded, treat secrets on or behind the host as exposed.","generic":true,"sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]}],"persistence":[{"kind":"webshell","value":"PSEMHUB.war/x.jsp","detail":"Mandiant 25 Sep 2026 primary execution web shell filename. Hashes vary.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"webshell","value":"PSEMHUB.war/u.jsp (and u2.jsp)","detail":"Mandiant 25 Sep 2026 stager servlet used to upload Ple64.exe.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"webshell","value":"PSEMHUB.war/tunnel.jsp and tunnel.jspx","detail":"Mandiant 25 Sep 2026 Neo-reGeorg tunnel servlets.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"path","value":"PSEMHUB.war/Ple64.exe","detail":"Mandiant 25 Sep 2026 trojanized installer delivering SIDEEYE.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"kind":"path","value":"envmetadata/data/environment/*.xml","detail":"ZDI and Mandiant: planted XML read by XMLDecoder at PSEMHUB start.","sourceUrl":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","sourceDate":"2026-10-27"},{"kind":"path","value":"README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT","detail":"Mandiant 11 Jun 2026 defacement and extortion marker.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","sourceDate":"2026-06-11"},{"kind":"service","value":"MeshAgent (meshagent, meshagent.msh, meshagent.db under /tmp in earlier waves)","detail":"Mandiant: MeshCentral agents in May/July waves under the PeopleSoft service account; September used winmanage-me.network.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"}],"observedBehaviour":[{"title":"Percent-encoded PSEMHUB path to bypass WAF","detail":"Mandiant 25 Sep 2026: UNC6240 requested /%50SEMHUB/ instead of /PSEMHUB/ so WAF rules that match the literal path before URL decode would miss it.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"title":"Fileless command execution via PSEMHUB hub","detail":"Mandiant 25 Sep 2026: POST to /%50SEMHUB/hub returning command output in the HTTP response with no file written. On the host this appears as cmd.exe or /bin/sh spawned by WebLogic Java.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"},{"title":"Data theft and extortion","detail":"Mandiant: UNC6240 steals data and threatens to publish it on a leak site. First wave data appeared on the ShinyHunters DLS on 9 Jun 2026. Prepare for extortion communications.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","sourceDate":"2026-09-25"}],"evidence":[{"title":"Installed PeopleTools version and patch state from before the upgrade","detail":"Preserve the version you recorded against the Security Alert so you can show whether the host was 8.61 or 8.62 while PSEMHUB or PSIGW was reachable.","sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"}]},{"title":"Copies of unexpected files under PSEMHUB.war and PORTAL.war","detail":"Keep x.jsp, u.jsp, tunnel.jsp, tunnel.jspx, Ple64.exe, and any other unexpected JSP or EXE, plus their timestamps, before restore or upgrade.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]},{"title":"envmetadata contents and web-tier restart logs","detail":"Trend Micro (18 Jun 2026): preserve envmetadata contents and web-tier restart logs first. A planted XML object may sit dormant until the next restart.","sources":[{"url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18","publisher":"Trend Micro"}]},{"title":"Access logs for PSEMHUB, encoded PSEMHUB, and PSIGW from 27 May 2026","detail":"Keep inbound session records. No invented attacker IPs beyond the Mandiant lists already on this page.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"}]}],"limits":["The Hacker News (28 Oct 2026): sources do not settle whether applying the patch removes access an attacker already gained. Mandiant's rotate-and-hunt guidance assumes it does not.","Trend Micro: a quiet SIEM is the predictable shape of in-JVM execution, not clearance.","Public Oracle HTML does not reprint PAD workaround text.","Web-shell source from Mandiant figures is not copied here."],"sources":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","publisher":"Oracle"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","publisher":"Mandiant / GTIG"},{"url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","date":"2026-10-28","publisher":"The Hacker News"},{"url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18","publisher":"Trend Micro"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"bulletins":[{"vendor":"Oracle","title":"Oracle Security Alert Advisory - CVE-2026-35273","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","cve":"CVE-2026-35273"}],"coverage":[{"title":"Oracle Security Alert Advisory - CVE-2026-35273","publisher":"Oracle","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","date":"2026-06-10","type":"vendor","addedDate":"2026-10-29"},{"title":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","publisher":"Mandiant / GTIG","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","date":"2026-06-11","type":"research","addedDate":"2026-10-29"},{"title":"ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft","publisher":"Mandiant / GTIG","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","date":"2026-09-25","type":"research","addedDate":"2026-10-29"},{"title":"CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft","publisher":"TrendAI Zero Day Initiative (Bobby Gould)","url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","date":"2026-10-27","type":"research","addedDate":"2026-10-29"},{"title":"PeopleSoft PeopleTools Pre-Authentication RCE","publisher":"Trend Micro (Jacob Santos)","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","date":"2026-06-18","type":"research","addedDate":"2026-10-29"},{"title":"Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)","publisher":"Rapid7 (Jonah Burgess)","url":"https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/","date":"2026-06-12","type":"research","addedDate":"2026-10-29"},{"title":"Active Exploitation of Oracle PeopleSoft Environment Management","publisher":"Kudelski Security","url":"https://kudelskisecurity.com/research/active-exploitation-of-oracle-peoplesoft-environment-management","date":"2026-06-12","type":"research","addedDate":"2026-10-29"},{"title":"ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble","publisher":"The Register","url":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"NVD CVE-2026-35273","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35273","date":"2026-06-11","type":"government","addedDate":"2026-10-29"},{"title":"CISA Known Exploited Vulnerabilities catalog","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-06-12","type":"government","addedDate":"2026-10-29"}],"posts":[],"research":[{"title":"Oracle Security Alert Advisory - CVE-2026-35273","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","authors":"Oracle (credit: Bobby Gould and Minh Giang, TrendAI ZDI; Lucas Miller, TrendAI Research)","date":"10 Jun 2026"},{"title":"CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft","url":"https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft","authors":"Bobby Gould, TrendAI Zero Day Initiative","date":"27 Oct 2026"},{"title":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit","authors":"Mandiant / Google Threat Intelligence Group","date":"11 Jun 2026"},{"title":"ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","authors":"Mandiant / Google Threat Intelligence Group","date":"25 Sep 2026"},{"title":"PeopleSoft PeopleTools Pre-Authentication RCE","url":"https://www.trendmicro.com/en/research/26/f/PeopleTools.html","authors":"Jacob Santos, Trend Micro","date":"18 Jun 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-35273 listed; catalog 2026.10.28)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"dateAdded 12 Jun 2026, catalog 2026.10.28, checked 29 Oct 2026"}],"impact":{"kind":"single-product","product":"Oracle PeopleSoft Enterprise PeopleTools","versions":[{"version":"PeopleSoft Enterprise PeopleTools 8.61","status":"affected","versions":"apply the CVE-2026-35273 Security Alert patch (Patch Availability Document on My Oracle Support)","vendorStatement":{"date":"2026-06-10","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","quote":"This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution."},"addedDate":"2026-10-29"},{"version":"PeopleSoft Enterprise PeopleTools 8.62","status":"affected","versions":"apply the CVE-2026-35273 Security Alert patch (Patch Availability Document on My Oracle Support)","vendorStatement":{"date":"2026-06-10","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","quote":"This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution."},"addedDate":"2026-10-29"},{"version":"PeopleSoft Enterprise Applications","status":"affected","versions":"apply the CVE-2026-35273 Security Alert patch (Patch Availability Document on My Oracle Support)","vendorStatement":{"date":"2026-06-10","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","quote":"Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability."},"statusLabel":"May be affected (Oracle)","addedDate":"2026-10-29"},{"version":"Earlier unsupported PeopleTools releases","status":"affected","versions":"Upgrade to a supported 8.61 or 8.62 release and apply the CVE-2026-35273 Security Alert patch (Patch Availability Document on My Oracle Support)","vendorStatement":{"date":"2026-06-10","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","quote":"Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Security Alert. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities."},"statusLabel":"Likely affected (Oracle: not tested)","addedDate":"2026-10-29"}]},"pocs":[],"pocEmptyState":"No public PoC indexed. ZDI 27 Oct 2026 is technical analysis, not a PoC. A ProjectDiscovery Nuclei scanner exists (first commit 16 Jun 2026 per GitHub history, checked 29 Oct 2026); it is linked under Detection, not as an RCE PoC, and this site does not copy its request body. Other GitHub repositories that claim a PoC were not independently validated and are not linked.","_feed":{"page":"https://vuln2shell.com/vulns/oracle-peoplesoft-cve-2026-35273","json":"https://vuln2shell.com/vulns/oracle-peoplesoft-cve-2026-35273.json","iocsCsv":"https://vuln2shell.com/vulns/oracle-peoplesoft-cve-2026-35273/iocs.csv","stix":"https://vuln2shell.com/vulns/oracle-peoplesoft-cve-2026-35273/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"No public PoC indexed"}}}