{"id":"oracle-peoplesoft-peopletools-auth-bypass-jun-2026","category":"patch","status":"closed","title":"Oracle PeopleSoft PeopleTools sign-in bypass CVE-2026-35273 exploited by ShinyHunters; fix released","tldr":"Oracle PeopleSoft PeopleTools 8.61 and 8.62 flaw CVE-2026-35273 lets attackers take over servers without a password. ShinyHunters used it from 27 May. Oracle patched it 10 June. Organisations running PeopleSoft should patch and check for prior compromise.","summary":"CVE-2026-35273 is a critical flaw (CVSS 9.8) in the Updates Environment Management part of Oracle PeopleSoft Enterprise PeopleTools, the platform many universities, hospitals and governments use for HR, payroll and student records. An attacker with web access can take over the application without logging in. Google Threat Intelligence and Mandiant say the ShinyHunters group (UNC6240) exploited it as a zero-day from 27 May to 9 June 2026, mostly against universities. Oracle released an out-of-band Security Alert on 10 June, and CISA listed the flaw as exploited on 12 June, marking it as used in ransomware. The sources I read describe data theft and extortion, not confirmed ransomware. On 26 September Google reported the group had changed its method to get around blocking rules and was attacking dozens more systems. Patching is the fix; blocking rules alone are not enough. This is mainly a business and institutional risk, though families may be affected if their school, university or health provider's data is taken. I could not open Oracle's own advisory.","action":"Nothing to install on a personal device. If you run PeopleSoft, apply Oracle's Security Alert for CVE-2026-35273 and look for signs of earlier compromise. If a university or employer notifies you of a breach, change your passwords and watch for scam messages.","product":"Oracle PeopleSoft Enterprise PeopleTools","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-35273"],"tags":["oracle","peoplesoft","peopletools","zero-day","shinyhunters","cisa-kev","extortion","universities"],"affected":["Oracle PeopleSoft Enterprise PeopleTools 8.61","Oracle PeopleSoft Enterprise PeopleTools 8.62"],"fixed":["Oracle Security Alert for CVE-2026-35273 (10 June 2026): latest PeopleTools patches for 8.61 and 8.62"],"matches":[],"sources":[{"kind":"advisory","title":"Oracle Security Alert for CVE-2026-35273","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","by":"Oracle","date":"2026-06-10"},{"kind":"research","title":"ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","by":"Google Cloud","date":"2026-09-26"},{"kind":"advisory","title":"Oracle PeopleSoft remote code execution vulnerability CVE-2026-35273","url":"https://www.yorku.ca/uit/infosec/2026/06/16/oracle-peoplesoft-remote-code-execution-vulnerability-cve-2026-35273/","by":"York University","date":"2026-06-16"}],"started":"2026-06-10","closed":"2026-09-26","created":"2026-11-03T22:02:06.413Z","updated":"2026-11-03T22:02:06.413Z","cve_notes":[{"cve":"CVE-2026-35273","name":"Missing authentication in PeopleSoft PeopleTools","what":"A missing-authentication flaw in the Updates Environment Management component of PeopleSoft PeopleTools that lets an attacker with web access run code and take over the application without a password.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-26","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Google reported that after the patch the group changed its method to slip past blocking rules and resumed mass exploitation, hitting dozens of systems worldwide across universities, technology, healthcare, government and other sectors.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","by":"Google Cloud","patch":null},{"at":"2026-06-16","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"York University's security team described the flaw as affecting PeopleTools 8.61 and 8.62, rated CVSS 9.8, and told administrators to install the latest PeopleTools patches.","url":"https://www.yorku.ca/uit/infosec/2026/06/16/oracle-peoplesoft-remote-code-execution-vulnerability-cve-2026-35273/","by":"York University","patch":null},{"at":"2026-06-12","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-35273 to its list of flaws being used in attacks, and marked it as used in ransomware. The reports I read describe data theft and extortion; I found no confirmed ransomware case.","url":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","by":"Oracle","patch":null},{"at":"2026-06-10","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"Oracle released an out-of-band Security Alert for CVE-2026-35273, a missing-authentication flaw in PeopleSoft Enterprise PeopleTools.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","by":"Google Cloud","patch":"patched"},{"at":"2026-05-27","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Google Threat Intelligence and Mandiant say the ShinyHunters group (UNC6240) began exploiting CVE-2026-35273 in Oracle PeopleSoft as a zero-day, mostly against universities. This ran until 9 June.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft","by":"Google Cloud","patch":"none"}],"url":"https://hard.fyi/live/oracle-peoplesoft-peopletools-auth-bypass-jun-2026/","json":"https://hard.fyi/api/live?id=oracle-peoplesoft-peopletools-auth-bypass-jun-2026"}