Analysis of the Oracle PeopleSoft vulnerability tracked as CVE-2026-35273 reveals it consists of three chained flaws affecting Enterprise PeopleTools versions 8.61 and 8.62.
Researchers detailed how the SSRF and path-bypass mechanisms enabled attacks attributed to ShinyHunters.
How did the problem work?
The researchers who discovered the flaws explained that the system allowed unknown parties to send requests from the internet and reach an internal management area that should normally be protected. This happened because the program considered local connections to the device itself to be trusted by default.
By exploiting this vulnerability, attackers could perform actions remotely without requiring a login password. In fact, it was found that attackers were able to bypass security measures by simply changing one character in the address of the website they were requesting.
The waves of attacks and the targets
The hacking group known as ShinyHunters exploited this issue in two main waves of attacks. The first wave occurred between May 27 and June 9, 2026, primarily targeting universities. A second, larger wave followed in September 2026, affecting technology companies, IT services, healthcare, agriculture, transportation, and government organizations worldwide.
What should those affected do?
Oracle released an emergency security update to close the gap on June 10, 2026. However, experts point out that simply installing the update is not enough if someone has already managed to get into the system.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Company offers $1 million reward for identifying hacker
↗
For this reason, those affected are urged to carefully check their computers for any signs of compromise, to safeguard relevant data, and to change their digital keys, as this group is stealing data and demanding ransom.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)