[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffM_Dhwmom4C6ZLgMeDmATHWf5c35mreIus3TwCfVoEk":3},{"article":4,"iocs":51,"watch_terms":66,"solutions":67,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7d9ae881-5907-47ce-a37c-7de51c67194a","ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws","shinyhunters-exploited-oracle-peoplesoft-zero-day-turns-out-to-be-three-chained-1417a6","The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address","The critical Oracle PeopleSoft vulnerability exploited by ShinyHunters since May is actually a chain of three distinct flaws, according to researchers. Oracle patched these as CVE-2026-35273 in June, which allows unauthenticated remote code execution. The exploit chain begins with a server-side request forgery (SSRF) that bypasses trust checks by targeting the internal loopback address, leading to code execution through abuse of logging functions or malicious XML files.","Oracle PeopleSoft zero-day exploited by ShinyHunters involves three chained flaws.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fshinyhunters-exploited-oracle.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjgiU-iVEycp9z-2dprGJhgl046M9ZvG7kGGwaXNzgFJg7XDubOoWWLvEuKAOczIcGuXU04db46Xa6pRMKO36ZS7Fu8Xkv7mNuPjHUS0zLTHkGlNWNRD2DLCznPf6jqvqamZSZGMBXSzh9gMYm-9sR-y7OgN7i7n6x0dfYxyl9QftWlfuQw0mpTteHy57k\u002Fs1600\u002Fsh.jpg","2026-10-28T06:04:58+00:00","2026-10-28T08:00:20.07997+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"PeopleSoft","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":25},"ShinyHunters","threat_actor",{"name":27,"type":28},"UNC6240","campaign",{"name":30,"type":19},"PeopleSoft Enterprise PeopleTools",{"name":32,"type":22},"Zero Day Initiative","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,46],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60,63],{"type":53,"value":54,"context":55},"cve","CVE-2026-35273","Identifier for the chained Oracle PeopleSoft vulnerability",{"type":57,"value":58,"context":59},"mitre_attack","T1587.001","Exploitation of Vulnerability (Server-Side Request Forgery)",{"type":57,"value":61,"context":62},"T1059.001","Exploitation of Vulnerability (Command and Scripting Interpreter: PowerShell)",{"type":57,"value":64,"context":65},"T1505.003","Exploitation of Vulnerability (Server Software Component: Web Shell)",[21,32,18],{"controls":68,"vendors":154},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":99,"product_name":115,"url":116,"description":117},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":50,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[155,161],{"slug":156,"name":157,"logo_path":158,"roles":159},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[160],"reported_by",{"slug":162,"name":21,"logo_path":163,"roles":164},"oracle","\u002Fvendor-logos\u002Foracle.png",[165],"affected",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"oracle-peoplesoft-zero-day-chain-exploited-before-patch-deployment","Oracle PeopleSoft Zero-Day Chain Exploited Before Patch Deployment","ShinyHunters exploited a chain of three distinct flaws in Oracle PeopleSoft — SSRF, logging function abuse, and malicious XML processing — that together enabled unauthenticated remote code execution, patched collectively as CVE-2026-35273 in June. The root issue is that organizations were running unpatched internet-facing enterprise software during an active exploitation window that began in May, weeks before the official fix. Chained exploits like this are especially dangerous because each individual flaw may appear low-severity in isolation, masking the critical risk of their combination. This incident underscores that vulnerability management programs must account for complex exploit chains, not just standalone CVEs, and that patching cadence for internet-facing systems must be treated as a priority response.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies; organizations running critical enterprise ERP systems like PeopleSoft without rapid patch deployment processes fall short of this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly; any PeopleSoft environment processing payment-related data that remained unpatched during active exploitation would be in direct violation.","SI-2 requires organizations to identify, report, and correct information system flaws — formalizing an emergency remediation process for critical CVEs would have driven faster deployment of Oracle's patch.","PeopleSoft instances running without the June patch exemplify the risk of outdated components; OWASP A06 specifically warns that unpatched enterprise software is a primary attack vector for remote code execution.","Active exploitation began in May while the patch did not arrive until June; a continuous vulnerability management program with defined patching SLAs for critical internet-facing systems would have minimized the exposure window.","This control mandates timely identification and remediation of technical vulnerabilities in systems; had organizations followed it rigorously, the chained PeopleSoft flaws would have been patched before ShinyHunters could exploit them.","The SSRF component of the exploit chain bypassed trust checks by spoofing the internal loopback address, highlighting a failure in access control design that this control — governing how trust is established and verified — would directly address."]