ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft flaw that ShinyHunters has exploited since May is not one vulnerability but three chained together, according to the Zero Day Initiative researchers who reported it. Oracle patched all three in June under the single identifier CVE-2026-35273 (CVSS 9.8): a server-side request forgery in the Integration Gateway reaches the internal Environment Management Hub because PeopleSoft trusts its own loopback address by default, from which attackers can write a web shell or a malicious XML file for unauthenticated remote code execution; Mandiant attributes the exploitation, first against universities and later across many sectors, to ShinyHunters (UNC6240).