Vulnerabilities · 4h ago

ShinyHunters Claim PeopleSoft Zero-Day Broke FBI Defenses

ShinyHunters claimed it used a new Oracle PeopleSoft zero-day, CVE-2026-35273, to break into an FBI system and steal employee data, while analysts said the exposure goes beyond a simple patch issue. Security voices singled out PeopleSoft’s Environment Management Hub and Integration Broker as components that should not be left reachable from the public internet.

The problem is the management path, not normal user login. If attackers can reach those admin modules, they can use the admin plane as a back door into the PeopleSoft environment, and a server-side foothold can expose credentials and other secrets the system can read.

For PeopleSoft shops that expose those components, the lasting risk is that a patched core can still sit behind an internet-facing management layer. The reporting also leaves open how many deployments have that path open, which is the exposure that now matters most.

CVE-2026-35273

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 9% (95th percentile).

CISA federal remediation date Jun 15 · date passed

Timeline

Oct 6 Reported by CSO Online
Jun 15 CISA federal deadline for CVE-2026-35273 passed
Jun 12 CVE-2026-35273 added to CISA KEV

Sources

1 source covering this story

CSO Online Oct 6
ShinyHunters’ exploitation of a new PeopleSoft zero-day hole threatens to change enterprise risk dynamics
One prominent analyst recommends that PeopleSoft customers pull the Environment Management Hub and the Integration Broker off the public internet.

Entities

CVE-2026-35273
ShinyHunters

Part of the PlainSec briefing for 2026-10-06

Editions

Briefing for 2026-10-06

Vulnerabilities · 4h agoShinyHunters Claim PeopleSoft Zero-Day Broke FBI DefensesShinyHunters claimed it used a new Oracle PeopleSoft zero-day, CVE-2026-35273, to break into an FBI system and steal employee data, while analysts said the exposure goes beyond a simple patch issue. Security voices singled out PeopleSoft’s Environment Management Hub and Integration Broker as components that should not be left reachable from the public internet.The problem is the management path, not normal user login. If attackers can reach those admin modules, they can use the admin plane as a back door into the PeopleSoft environment, and a server-side foothold can expose credentials and other secrets the system can read.For PeopleSoft shops that expose those components, the lasting risk is that a patched core can still sit behind an internet-facing management layer. The reporting also leaves open how many deployments have that path open, which is the exposure that now matters most.