What happened
Organisations running Oracle PeopleSoft are currently facing active exploitation of a critical security vulnerability identified as CVE-2026-35273. This flaw allows unauthenticated remote code execution and has been weaponised by malicious actors affiliated with the ShinyHunters group. The exploitation campaign has been observed to bypass Web Application Firewalls (WAFs), facilitating wider-reaching attacks. Exploitation is confirmed to be ongoing in the wild, with no vendor patch available at the time of initial discovery, indicating a zero-day status at disclosure. The vulnerability was first exploited as a zero-day, highlighting the urgency and severity of the threat. The campaign targets multiple sectors globally, with attackers deploying web shells after bypassing security measures. Google has issued warnings confirming the widespread nature of these activities and the potential impact on vulnerable systems.
Who is affected
Any organisation running Oracle PeopleSoft deployments is potentially at risk from this ongoing exploitation. Affected systems that have not implemented security controls to mitigate the specific attack vector are particularly vulnerable. Since the vulnerability allows unauthenticated remote code execution, attackers may obtain persistent or unauthorised access to affected environments, potentially leading to data breaches or further malicious activity. The campaign’s global reach and active exploitation underscore the importance of vigilance across sectors that rely on Oracle PeopleSoft solutions, especially those without immediate remediation measures in place.
Recommended actions
- Implement security controls that address the specific attack vector exploited in this campaign, especially those that can detect or prevent unauthenticated remote code execution, including strict inbound network filtering.
- Review network perimeter security policies to restrict unauthenticated access to vulnerable systems and monitor for suspicious activity indicative of web shell deployment.
- Verify the security posture of applications handling Oracle PeopleSoft functionalities, with attention to monitoring and logging for any signs of exploitation or compromise.
- Apply vendor-provided patches and updates when available, and explore workarounds or mitigations that reduce exposure until official patches are released.
- Ensure the implementation of ongoing security monitoring and threat intelligence updates to stay informed on active campaign developments and indicators of compromise.
Indicators of compromise
N/A
