Oracle Mitigates PeopleSoft Zero-Day in ShinyHunter Attacks

Oracle has issued an emergency mitigation for a critical zero-day vulnerability in its PeopleSoft Suite that is actively exploited in data theft attacks by the ShinyHunters extortion gang.

Oracle discloses CVE-2026-35273 with a 9.8 CVSS score. The flaw resides in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62 and allows unauthenticated remote code execution. Oracle's advisory states the vulnerability is remotely exploitable without authentication and, if successfully exploited, may result in remote code execution.

The company confirmed that Oracle PeopleSoft Enterprise Applications customers may also be affected. Oracle has released emergency mitigations and said a patch is coming soon.

ShinyHunters used the zero-day to breach over 100 organizations. BleepingComputer first reported that the gang was exploiting a PeopleSoft zero-day to steal data, and has since confirmed that CVE-2026-35273 is the flaw involved. The group left ransom notes on compromised instances and claimed to use a gadget chain of old and zero-day flaws.

ShinyHunters allegedly stole data from 300 instances belonging to more than 100 organizations. The gang is known for targeting cloud SaaS instances, CRMs, and enterprise platforms that host large volumes of corporate data, then demanding ransom to prevent public leaks. It has previously been linked to high-profile attacks on Snowflake, Salesforce, and third-party integration providers over the past year.

Mandiant confirms active exploitation and Oracle's response. Charles Carmakal, CTO at Mandiant - Google Cloud, confirmed on LinkedIn that CVE-2026-35273 is actively exploited and that Oracle has released mitigations. Cybersecurity researcher "Michael R" identified exposed online directories with attack-related tooling and listed IP addresses used in the attacks.

The IP addresses are 142.11.200.186, 142.11.200.187, 142.11.200.188, 142.11.200.189, 142.11.200.190, 108.174.202.99, and 176.120.22.24. Oracle has not directly stated that the vulnerability is actively exploited in its advisory. BleepingComputer reached out to Oracle for comment but has not received a response.

Organizations running PeopleSoft are urged to check logs immediately. Administrators are strongly advised to analyze logs for connections from the listed IP addresses to determine if they were targeted. The disclosure arrives on the same day as Oracle's advisory, June 11, 2026.