Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-35273 | 9.8 | 95.5% | ✅ listed | available | 89.59 (Critical) |
Zero-Day Exploited in Active Extortion Campaign
ShinyHunters, tracked as UNC6240, actively exploited CVE-2026-35273 in a zero-day campaign targeting Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. The critical flaw resides in the Updates Environment Management component, specifically within PSEMHUB, allowing unauthenticated attackers with network access via HTTP to execute arbitrary code on vulnerable servers. This vulnerability carries a CVSS score of 9.8 and an EPSS probability of 95.5%, reflecting its high exploitability and risk profile.
The attack activity was observed between May 27 and June 9, 2026, preceding Oracle’s release of the advisory and patches on June 10, 2026. Attackers leveraged the remote code execution capability to deploy disguised MeshCentral agents for persistent remote access and lateral movement. The campaign primarily targeted higher education institutions, with approximately 68% of identified victims belonging to that sector. Following initial compromise, threat actors conducted reconnaissance of enterprise infrastructure and stole data to facilitate extortion operations.
Victims: University of Nottingham and Mackay Sugar
The University of Nottingham was among the institutions breached by ShinyHunters during their exploitation of CVE-2026-35273. The group leveraged the critical flaw in Oracle PeopleSoft to gain unauthorized access, consistent with a broader pattern where approximately 68% of identified victims were drawn from the higher education sector.
Beyond academic targets, the campaign extended into industrial operations, disrupting Mackay Sugar as part of the threat actors' extortion activities. Following initial compromise at these sites, attackers conducted reconnaissance and exfiltrated data to support their ransom demands.
How the Attackers Gained Access
The intrusion began with unauthenticated remote code execution against the PSEMHUB interface within Oracle PeopleSoft’s Updates Environment Management component. Because the vulnerability required no prior credentials, threat actors were able to breach internet-facing deployments directly over HTTP. Once initial footholds were secured on vulnerable servers running versions 8.61 or 8.62, the group moved quickly to entrench their presence.
To maintain persistent access and facilitate lateral movement, attackers deployed disguised MeshCentral agents alongside legitimate administration tools. These implants allowed them to operate within compromised networks without triggering standard security alerts. Following this initial compromise, the threat actors conducted extensive reconnaissance of enterprise infrastructure and configurations, mapping internal assets to identify high-value targets for data exfiltration and subsequent extortion.
Timeline and Detection Indicators
Active exploitation of CVE-2026-35273 was documented between May 27 and June 9, 2026. This period predates Oracle’s public disclosure and patch release on June 10, confirming the vulnerability was exploited as a zero-day during this window. Security teams should prioritize reviewing network and system logs from these specific dates to identify indicators of compromise that may have been missed by automated defenses.
Hunting efforts must focus on detecting unauthorized remote management tools installed on PeopleSoft servers. Specifically, analysts should search for MeshCentral agents or similar administration utilities that were not part of the original deployment configuration. The presence of such tools on internet-facing systems running PeopleTools versions 8.61 or 8.62 is a strong indicator of persistent access established by threat actors.
Mitigation Steps for Exposed Systems
Organizations running Oracle PeopleSoft must immediately deploy the security patches released by Oracle to remediate CVE-2026-35273. Because the vulnerability permits unauthenticated remote code execution over HTTP, any internet-facing deployment of PeopleTools versions 8.61 or 8.62 should be treated as potentially compromised until a thorough review is completed. To reduce the attack surface while patching is underway, administrators should restrict external network access to the PeopleSoft Environment Management services, ensuring that only authorized internal traffic can reach these components.
Key points
- CVE-2026-35273 is a critical remote code execution vulnerability in the PeopleSoft Enterprise PeopleTools Updates Environment Management component, affecting versions 8.61 and 8.62.
- The flaw allows unauthenticated attackers with network access via HTTP to execute arbitrary code on vulnerable servers without prior credentials.
- ShinyHunters (UNC6240) conducted an active compromise and extortion campaign from May 27 to June 9, 2026, primarily targeting higher education institutions.
- Attackers deployed disguised MeshCentral agents for persistent remote access and lateral movement within compromised environments.
- Oracle disclosed the vulnerability on June 10, 2026, after active exploitation had already occurred in the wild.