Oracle has issued an emergency security alert for a critical zero-day vulnerability in its PeopleSoft Enterprise suite, confirming that the flaw is being actively exploited in data theft attacks attributed to the ShinyHunters extortion group. Tracked as CVE-2026-35273, this unauthenticated remote code execution vulnerability carries a CVSS base score of 9.8, placing it among the most severe categories of software flaws. The advisory impacts Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, and the company has released emergency mitigations while a permanent patch is prepared.
Critical PeopleSoft Zero-Day CVE-2026-35273 Under Active Exploitation
The vulnerability resides within Oracle PeopleSoft PeopleTools, the technology stack underpinning PeopleSoft Enterprise Applications. Oracle’s advisory confirms that the flaw is “remotely exploitable without authentication” and that successful exploitation “may result in remote code execution.” This means an attacker with network access to an affected system can execute arbitrary commands without needing any credentials or user interaction. The alert follows investigative reporting that initially identified a wave of data theft attacks targeting PeopleSoft instances, with ransom notes left by ShinyHunters. Security researchers, including Charles Carmakal, CTO at Mandiant (Google Cloud), have publicly confirmed that CVE-2026-35273 is the zero-day being used in these campaigns.
ShinyHunters Breach Campaign: Scope and Methodology
ShinyHunters is a well-known threat actor specializing in breaching cloud SaaS platforms, CRM systems, and enterprise databases to exfiltrate large volumes of corporate data. The group typically secures access, downloads the stolen data, and then demands a ransom to prevent its public release. In this campaign, ShinyHunters has confirmed to researchers that it is exploiting a “gadget chain” combining old vulnerabilities and this new zero-day flaw to compromise PeopleSoft instances. The threat actor claims to have stolen data from approximately 300 instances belonging to over 100 organizations.
Cybersecurity researcher Michael R identified several exposed online directories containing tooling related to the attacks. The following IP addresses have been associated with the exploitation activity and should be immediately investigated by any organization running PeopleSoft:
- 142.11.200[.]186
- 142.11.200[.]187
- 142.11.200[.]188
- 142.11.200[.]189
- 142.11.200[.]190
- 108.174.202[.]99
- 176.120.22[.]24
Administrators are strongly advised to audit logs for any connections originating from these IPs to determine if their environments have been targeted.
What Is CVE-2026-35273 and How Does It Work?
CVE-2026-35273 is an unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools. Because the flaw requires no authentication and no user interaction, it presents a direct and immediate risk to any exposed, unpatched PeopleSoft server. An attacker can exploit it over a network to execute arbitrary code, which can then be used to implant backdoors, escalate privileges, or exfiltrate sensitive data. The CVSS score of 9.8 reflects the ease of exploitation and the potential for total compromise of the affected system’s confidentiality, integrity, and availability. Organizations that have not yet applied the available emergency mitigations should treat this as an active, high-priority threat.
Urgent Mitigation Steps for Oracle PeopleSoft Administrators
Oracle has released emergency mitigations for CVE-2026-35273, with a full security patch expected shortly. In the interim, organizations running PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62 must take immediate action. The first step is to restrict network access to PeopleSoft servers, ensuring they are not directly exposed to the internet. Administrators should review firewall rules to block traffic from untrusted networks and verify that only necessary ports and services are open. Concurrently, log analysis for connections from the IP addresses listed above is critical. Any sign of compromise should trigger an incident response protocol, including credential rotation and forensic analysis.
What Affected Organizations Should Do Now
For any organization using Oracle PeopleSoft, the window for preventive action is closing. The first and most critical step is to apply the emergency mitigations provided by Oracle immediately. This should be combined with a thorough review of system logs for any indicators of compromise, especially connections from the identified malicious IPs. Organizations should also enforce multi-factor authentication (MFA) on all administrative accounts, conduct a full review of privileged access, and prepare to apply the permanent patch as soon as it is released. This incident underscores the importance of maintaining a robust patch management process for enterprise applications and ensuring that critical systems are not left exposed to the public internet. ShinyHunters has demonstrated a focused capability to target enterprise platforms; treating this vulnerability with the highest level of urgency is the only appropriate response.
