NewsThe Hacker News28.10.2026

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

CVE-2026-35273Oracle PeopleSoft: Schwachstelle ermöglicht Codeausführung
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
CVE-2026-35273Critical Vulnerability in Oracle PeopleSoft Enterprise PeopleTools
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools: fehlende Authentifizierung
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Affected vendors and products

Oracle Peoplesoft
Oracle Oracle PeopleSoft Enterprise PT PeopleTools
Oracle Corporation Peoplesoft Enterprise Peopletools

Source: https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html

Linked advisories

Affected vendors and products