ShinyHunters Chains Three Flaws in Oracle PeopleSoft Zero-Day

Introduction

What initially appeared to be a single critical zero-day in Oracle PeopleSoft has been revealed as a trio of chained vulnerabilities, according to the security researchers who reported the issue. The flaws were actively exploited by the ShinyHunters threat actor group beginning in May, and Oracle addressed all three under a single identifier, CVE-2026-35273, in its June patch release. The disclosure sheds light on how attackers can combine seemingly minor weaknesses into a powerful exploit chain targeting enterprise applications.

The Anatomy of the Chained Exploit

Researchers identified that the exploit begins with a server-side request forgery (SSRF) vulnerability within the PeopleSoft application stack. The SSRF allows an attacker to direct the server to make requests to internal resources that should not be directly accessible. In this case, the flaw enables communication with an internal management interface that the application trusts because it originates from the server's own loopback address (127.0.0.1). This trust model is common in enterprise applications that assume internal traffic is inherently safe, a dangerous assumption that attackers routinely exploit.

The SSRF serves as the entry point, but the full compromise requires two additional vulnerabilities to be chained together. While the specific technical details of the second and third flaws were not disclosed in full to prevent further exploitation, researchers confirmed that they allow privilege escalation and ultimately remote code execution. This combination turns what might otherwise be a limited SSRF into a full server compromise.

ShinyHunters' Active Exploitation

The vulnerability was not discovered in a lab environment; it was actively used by the ShinyHunters group, known for targeting large organizations and stealing sensitive data. The group began exploiting the flaw in May, several weeks before Oracle released its patch in June. This timeline highlights the critical importance of rapid vulnerability response and the challenges organizations face in keeping up with zero-day threats that are already in the wild.

ShinyHunters has a history of leveraging previously unknown vulnerabilities to gain initial access to enterprise networks. Their use of this chained exploit demonstrates a sophisticated understanding of application architecture and the trust relationships that underpin enterprise software. Organizations running Oracle PeopleSoft, particularly those exposed to the internet, were at significant risk during the window between May and the June patch release.

Who Is Affected and What Defenders Should Do

Organizations using Oracle PeopleSoft applications are the primary targets. This includes enterprises in sectors such as human resources, finance, supply chain, and government that rely on PeopleSoft for core business functions. Any organization that has not yet applied the June patch should treat CVE-2026-35273 as a critical priority.

Defenders should take the following immediate steps: First, apply the Oracle June Critical Patch Update that includes the fix for CVE-2026-35273. Second, audit network configurations to ensure that internal management interfaces are not reachable from public-facing application servers. Third, implement network segmentation to limit lateral movement in the event of a compromise. Finally, review logs for signs of SSRF activity or unusual internal requests that could indicate prior exploitation.

Conclusion

The revelation that CVE-2026-35273 encompasses three chained vulnerabilities underscores the complexity of modern exploit development and the need for layered defense strategies. As threat actors continue to refine their techniques, organizations must remain vigilant in patching, monitoring, and architecting their systems with security as a foundational principle. Grivyonx's AI-driven security automation and DevSecOps integration services can help organizations detect and remediate vulnerabilities like these before they are exploited in the wild.