ShinyHunters Exploits Chained Oracle PeopleSoft Vulnerabilities

According to researchers, the critical Oracle PeopleSoft bug that ShinyHunters has been exploiting since May is not a single flaw but three chained vulnerabilities. The chain begins with a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address. The additional two flaws in the chain are not detailed in the initial reporting but are required for full exploitation. Oracle released patches for all three vulnerabilities under a single CVE identifier, CVE-2026-35273, in June 2026. The exploitation chain allows unauthenticated remote code execution on PeopleSoft systems. ShinyHunters has been actively exploiting this vulnerability since May 2026, potentially leading to data exfiltration and ransomware deployment. Oracle has urged all PeopleSoft users to apply the latest security updates immediately to mitigate the risk.