The ShinyHunters extortion group leveraged an unpatched vulnerability in Oracle PeopleSoft to infiltrate enterprise systems, exfiltrate data, and demand payment to prevent its disclosure. The campaign primarily targeted universities.
Google's Mandiant attributes the attacks to the group it monitors as UNC6240, placing the activity between May 27 and June 9. Oracle did not release its security advisory until June 10, meaning the flaw remained a zero-day throughout the operation.
The vulnerability, designated CVE-2026-35273, is a remote code execution issue in PeopleSoft Enterprise PeopleTools, with a severity rating of 9.8 out of 10. It requires no authentication or user interaction—only network access via HTTP—to seize control of the server. If your PeopleSoft deployment has the Environment Management Hub accessible from the internet, that constitutes your risk, and the immediate step is to restrict access to those endpoints.
The flaw resides in the Updates Environment Management component, which underpins the Environment Management Hub (PSEMHUB). Oracle lists PeopleTools versions 8.61 and 8.62 as affected and notes that earlier, unsupported versions are likely also vulnerable. It acknowledges researchers from TrendAI Zero Day Initiative and TrendAI Research for reporting the issue.
Mandiant CTO Charles Carmakal confirmed active exploitation of the bug in the wild; Oracle has not disclosed whether it has observed exploitation. Its advisory directs users to a patch availability document behind a support login, and it remains unclear whether a comprehensive fix is publicly accessible. For now, the recommended approach centers on mitigation.
Operational details emerged because the attackers left their own infrastructure exposed. Researcher @nahamike01 publicly flagged the open directories. Mandiant subsequently investigated five consecutive IP addresses running Python's SimpleHTTP server on port 8888. Those servers exposed staging files: a shared .bash_history, custom MeshCentral remote-management agents disguised as Microsoft Azure binaries, and a lateral-movement script.
The agents communicated with a command-and-control server at azurenetfiles.net, a domain crafted to mimic Azure NetApp Files. The script, named [victim]_fanout.sh, propagates over SSH by attempting a hardcoded list of usernames and passwords against internal hosts sourced from /etc/hosts, then deposits a marker file called README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into PeopleSoft directories. The command history indicates data was compressed with zstd and an outbound SSH connection was established to the server hosting the public mirror of the ShinyHunters leak site.
Mandiant notified over 100 organizations whose IP addresses matched vulnerable endpoints. Sixty-eight percent were in higher education, predominantly in the United States. Some blocked the activity; others were breached and had data posted to the leak site.
The University of Nottingham is among the first confirmed victims. Have I Been Pwned has tallied approximately 455,000 unique email addresses in the leaked dataset, encompassing current students and alumni, along with names, addresses, phone numbers, passport numbers, and details on ethnicity and disabilities. The university has acknowledged the breach.
Oracle's guidance includes disabling the Environment Management Hub service on multi-server configurations, or removing the PSEMHUB application entirely on single-server setups. If neither option is feasible, block external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the network perimeter.
Mandiant cautions that WAF body-inspection rules alone are insufficient, as they can be circumvented. Restricting these endpoints does not disrupt normal user sessions.
Then search for signs of an existing compromise:
WebLogic access logs indicating external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector.
Unexpected .jsp files within the PSEMHUB.war web application directory, or unusual folders named logs, persistantstorage, or scratchpad under the PSEMHUB paths.
Recently modified .xml files under the web doc root's envmetadata/data/environment, which can be exploited for XMLDecoder persistence that activates on the next restart.
Outbound SMB traffic on port 445 from PeopleSoft hosts to external destinations, which the exploit chain may use to capture machine-account NetNTLM hashes.
Apply Oracle's update for your PeopleTools version once you confirm its availability in My Oracle Support.
ShinyHunters indicates that victim outreach has only recently begun, and it has not yet published most of the organizations it claims, so additional names are expected.
The method is the more significant indicator. ShinyHunters has recently relied on vishing, stolen tokens, and weak access controls to steal data from SaaS and education platforms, ranging from Salesforce customers to Canvas. A server-side zero-day in on-premises ERP software represents an escalation from that, targeting the same data-rich victims.
The unresolved question is whether this was a one-off borrowed zero-day or the beginning of ShinyHunters moving into ERP exploitation.