News

❓What:

• ShinyHunters (tracked by Mandiant as UNC6240) exploited an unpatched RCE flaw in Oracle PeopleSoft PeopleTools, CVE-2026-35273 (CVSS 9.8), between May 27 and June 9, 2026 — before Oracle's advisory landed on June 10, making it a true zero-day for the entire window

• The flaw sits in the Environment Management Hub (PSEMHUB) component and requires no authentication or user interaction — just HTTP network access to the exposed endpoint

• Affects PeopleTools 8.61 and 8.62; Oracle says older, unsupported versions are likely vulnerable too

• The intrusion came to light because attackers left their own staging servers exposed — open directories running Python SimpleHTTP on port 8888, discovered by researcher @nahamike01 and triaged by Mandiant

• Attacker toolkit included MeshCentral remote-access agents disguised as Azure binaries, a lookalike C2 domain (azurenetfiles.net), and a lateral-movement script that sprays hardcoded credentials over SSH

• Mandiant notified 100+ organizations with exposed, vulnerable endpoints — 68% in higher education, mostly U.S.-based

• University of Nottingham is a confirmed victim; ~455,000 unique email addresses were leaked, including names, addresses, phone numbers, passport numbers, and ethnicity/disability data

⚠️Impact:

• Full remote takeover of PeopleSoft servers with zero authentication barrier

• Confirmed data exfiltration and extortion at breached institutions, with data already posted to ShinyHunters' leak site

• Higher-education institutions are disproportionately exposed, likely due to widespread PeopleSoft use for student/HR systems and inconsistent patch/endpoint hygiene

• ShinyHunters has historically relied on vishing and stolen tokens (Salesforce, Canvas/Instructure); this marks a shift toward exploiting on-prem ERP zero-days directly — a meaningful escalation in capability

• ShinyHunters states outreach to victims is ongoing and more names are expected

💡Recommendations:

• Immediately disable the Environment Management Hub service (multi-server setups) or remove the PSEMHUB application entirely (single-server setups)

• If you can't do either, block external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the perimeter — this does not break normal user sessions

• Don't rely on WAF body-inspection rules alone; Mandiant confirms they can be bypassed

• Hunt for compromise indicators: external POSTs to PSEMHUB/PSIGW endpoints in WebLogic logs, unexpected .jsp files under PSEMHUB.war, unusual folders (logs, persistantstorage, scratchpad), recently modified environment-metadata XML files, and outbound SMB/445 traffic from PeopleSoft hosts

• Apply Oracle's PeopleTools patch as soon as it's confirmed available via My Oracle Support

Read the full story HERE