What happened
Between May 27 and June 9, 2026, the criminal group ShinyHunters (tracked by Mandiant and Google Threat Intelligence Group as UNC6240) exploited a zero-day in Oracle PeopleSoft, CVE-2026-35273, to breach more than 300 instances across 100+ organizations. Oracle issued an alert and an emergency patch on June 10, about two weeks after the attacks began.
About 68% of victims are in higher education, where PeopleSoft holds student, financial aid, payroll and HR data. The University of Nottingham confirmed exposure of about 454,600 records of current and former students, including names, addresses, passport numbers and sensitive data such as ethnicity and disability.
This post covers the original June campaign. In September we published a separate piece on the WAF bypass related to this CVE.
The flaw
- CVSS 9.8, no authentication and no user interaction.
- Affects the Environment Management (EMHub) component of PeopleTools 8.61 and 8.62.
- In short: a crafted HTTP request to the PSIGW gateway reaches an internal admin servlet (SSRF), which triggers unsafe Java deserialization and allows code execution on the server.
How the attack worked
According to Mandiant, the attackers set up a MeshCentral server (a legitimate remote-access tool) as command and control and installed agents named to mimic Azure services, such as meshagent64-azure-ops.exe. They then used a *_fanout.sh script to spray SSH credentials across internal servers and dropped a ransom note file. Extortion followed: pay or see the data published.
What to do
- Apply Oracle's patch (June 10 alert, included in the June CPU) as soon as possible.
- If you can't yet, disable EMHub or block external access to
/PSEMHUB/*and/PSIGW/HttpListeningConnector. - Hunt for signs of compromise: MeshCentral binaries, odd outbound connections and the ransom file.
- Rotate credentials and SSH keys present on PeopleSoft servers.
- If data leaked, prepare legal notifications (e.g. GDPR within 72 hours in Europe).
Lesson for businesses
ERP admin components should not be exposed to the internet. Putting these panels behind a VPN or identity-verified (zero trust) access would have blocked this attack. And critical flaws in exposed systems need an emergency patch window of 24 to 72 hours.
Sources
- Cloud Security Alliance, research note (30/06/2026): https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/
- The Register (11/06/2026), "ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day"
- Mandiant / Google Threat Intelligence Group, "ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit" (Google Cloud Blog, June 2026)
- NVD, CVE-2026-35273: https://nvd.nist.gov/vuln/detail/CVE-2026-35273
Does your company run ERP or other internet-facing systems? KGA IT offers a free exposure review: kga-it.com.