Executive Summary
In June 2026, Oracle disclosed CVE-2026-35273, a critical unauthenticated Remote Code Execution (RCE) vulnerability in PeopleSoft PeopleTools versions 8.61 and 8.62. Mandiant later revealed that the threat actor UNC6240, known as ShinyHunters, had been exploiting this flaw as a zero-day since at least May 27, 2026. The campaign primarily targeted the higher education sector (68% of victims), focusing on data exfiltration and extortion.
The attack chain involves an SSRF condition in `HttpListeningConnector` (ZDI-26-387) chained with unsafe deserialization in `HubMBeanPersistance` (ZDI-26-388) and path control weaknesses in `ExecuteProcessActivityCommand` (ZDI-26-389). This chain allows unauthenticated attackers to bypass security boundaries and execute code in the context of the PeopleSoft service account. Once established, attackers conducted internal reconnaissance, deployed customized MeshCentral remote-management agents, and moved laterally via SSH to exfiltrate HR, financial, and student data.
Because exploitation occurred before a patch was available, organizations must treat patching and compromise assessment as separate mandates. Successful exploitation leads to a total takeover of the PeopleSoft environment, including access to database credentials and sensitive institutional records.