ShinyHunters Exploits PeopleSoft Zero-Day CVE-2026-35273

ShinyHunters (tracked by Mandiant as UNC6240) has been observed exploiting CVE-2026-35273, a critical remote code execution (RCE) vulnerability in Oracle PeopleSoft PeopleTools. The campaign, which occurred between May 27 and June 9, 2026, targeted over 100 organizations globally, with nearly 70% concentrated in the higher education sector, including a confirmed breach of the University of Nottingham. Oracle has since released an advisory for the flaw, which allows unauthenticated attackers to achieve full system takeover via HTTP.

Technically, the attackers utilize a sophisticated attack chain involving the exploitation of the PeopleSoft Environment Management Hub (PSEMHUB). Once access is gained, the group deploys custom MeshCentral remote management agents disguised as Microsoft Azure binaries and uses lateral movement scripts to spray credentials across internal hosts. The primary motive is data extortion, with stolen data being compressed using zstd and exfiltrated to ShinyHunters' public leak site mirrors.

This activity represents a significant escalation in ShinyHunters' tradecraft, moving from social engineering and credential theft toward the exploitation of complex, on-premises ERP software. Organizations running PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62 should prioritize applying Oracle's security updates and implementing immediate network-level mitigations to block access to vulnerable endpoints.