ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

ShinyHunters exploited a chain of three distinct flaws in Oracle PeopleSoft — SSRF, logging function abuse, and malicious XML processing — that together enabled unauthenticated remote code execution, patched collectively as CVE-2026-35273 in June. The root issue is that organizations were running unpatched internet-facing enterprise software during an active exploitation window that began in May, weeks before the official fix. Chained exploits like this are especially dangerous because each individual flaw may appear low-severity in isolation, masking the critical risk of their combination. This incident underscores that vulnerability management programs must account for complex exploit chains, not just standalone CVEs, and that patching cadence for internet-facing systems must be treated as a priority response.