In 2026, CVE-2026-35273, a critical zero-day vulnerability affecting Oracle PeopleSoft PeopleTools, was publicly disclosed and confirmed to be under active exploitation. Oracle PeopleSoft is a widely used enterprise application suite covering human resources, finance, student information systems, and supply chain management, often serving as core infrastructure for large organizations, government agencies, and academic institutions.
This vulnerability is not simply the result of a misconfiguration or weak password policy. The core issue is that the affected versions of PeopleSoft PeopleTools contain a flaw that allows unauthenticated remote attackers to execute arbitrary code on the host system without any credentials. If the PeopleSoft interface is exposed to the internet, attackers can exploit this vulnerability directly through publicly accessible management and integration endpoints.
This article examines the technical root cause and attack flow of CVE-2026-35273 and analyzes how publicly exposed PeopleSoft assets create attack surfaces, using Criminal IP Asset Search.
CVE-2026-35273: Oracle PeopleSoft Vulnerability Overview
| Item | Details |
|---|---|
| Vulnerability ID | CVE-2026-35273 |
| Affected Product | Apache Solr |
| Affected Versions | PeopleTools 8.61, 8.62 |
| Vulnerability Type | Hardcoded Credentials / Insecure Default Initialization |
| CVSS Score | 9.8 (Critical) |
| Exploitation Status | Actively exploited in the wild |
| Known Threat Actor | ShinyHunters extortion group |
CVE-2026-35273 is a critical zero-day vulnerability in Oracle PeopleSoft Enterprise PeopleTools that enables unauthenticated remote code execution. Unlike vulnerabilities that require valid credentials or elevated privileges, this flaw can be triggered by any network attacker with access to a publicly exposed PeopleSoft endpoint, and no authentication of any kind is required.
Oracle has released emergency mitigations while a full patch is being prepared. The vulnerability specifically affects PeopleTools versions 8.61 and 8.62, which are widely deployed across enterprise and higher education environments globally. The ShinyHunters extortion group has confirmed active exploitation of this flaw, claiming responsibility for breaching 300 instances across more than 100 organizations using a gadget chain of old and zero-day flaws centered on CVE-2026-35273.
Technical Root Cause: Unauthenticated RCE via PeopleSoft Endpoints
Oracle PeopleSoft PeopleTools provides a set of integration and management endpoints that facilitate internal application communication, data exchange, and system administration. In vulnerable versions, these endpoints fail to enforce authentication before processing incoming requests, allowing remote attackers to submit malicious payloads directly.
Security researchers analyzing active exploitation activity identified two specific endpoints as primary targets:
- /PSEMHUB/ — the PeopleSoft Enterprise Management Hub
- /PSIGW/HttpListeningConnector — the PeopleSoft Integration Gateway HTTP Listening Connector
The risk unfolds as follows:
- An attacker identifies a publicly accessible PeopleSoft instance through internet-wide scanning
- The attacker submits a crafted request to the vulnerable endpoint without any authentication
- The request triggers remote code execution on the underlying host system
- The attacker establishes persistence through webshell deployment and lateral movement tools
- Data is exfiltrated and ransom demands are issued to the compromised organization
This becomes particularly dangerous because PeopleSoft environments typically hold some of the most sensitive organizational data in existence — employee records, financial data, student information, and payroll systems. A single successful exploitation can expose the entirety of an organization’s enterprise resource planning environment.
Attack Flow Scenario: From Public PeopleSoft Exposure to Full Compromise
An attack leveraging CVE-2026-35273 may proceed as follows:
First, attackers identify publicly accessible PeopleSoft interfaces through internet-wide scanning. Page titles, HTTP responses, and service banners can all be used as indicators. The title “Oracle PeopleSoft” and login page titles such as “PeopleSoft Sign-in” are particularly useful for identifying exposed management interfaces.
Once an exposed PeopleSoft instance is found, attackers submit crafted requests directly to the /PSEMHUB/ and /PSIGW/HttpListeningConnector endpoints without any authentication. Successful exploitation results in remote code execution on the host server.
Following initial access, security researchers observed threat actors conducting reconnaissance on compromised instances, mapping PeopleSoft and WebLogic configurations, and using scripts to move laterally across internal systems using stolen or hardcoded credentials. Custom remote management agents were deployed to communicate with attacker-controlled infrastructure masquerading as legitimate cloud services.
Finally, attackers compress and exfiltrate data to external staging servers before issuing ransom demands. The ShinyHunters group confirmed responsibility for the campaign, claiming to have breached 300 instances across more than 100 organizations using this attack chain.
Internet-Exposed PeopleSoft Assets Identified Through Criminal IP Asset Search
Oracle PeopleSoft is generally intended to operate within internal or restricted enterprise networks, accessible only through VPN or corporate network controls. However, in real-world environments, PeopleSoft interfaces are sometimes exposed due to misconfigured reverse proxies, cloud deployment oversights, or missing network-level access controls. Using Criminal IP Asset Search, the following queries were used to identify externally accessible PeopleSoft assets.
Criminal IP Asset Search results for title: Oracle PeopleSoft
Criminal IP Search Query: title: Oracle PeopleSoft
As of June 2026, a total of 468 publicly accessible assets were identified using this query. This indicates that a significant number of Oracle PeopleSoft interfaces remain discoverable from the public internet. The query title: Oracle PeopleSoft is an effective method for identifying exposed PeopleSoft deployments across all modules and configurations.
However, these results do not imply that all identified assets are vulnerable to CVE-2026-35273. Actual exposure depends on factors such as the PeopleTools version in use and whether emergency mitigations have been applied. Nevertheless, the mere existence of an externally accessible PeopleSoft interface provides attackers with an opportunity to identify versions, analyze endpoint configurations, and attempt exploitation of CVE-2026-35273. The results of this query should be interpreted not as the number of confirmed vulnerable systems, but as an indicator of how many PeopleSoft management interfaces are externally visible and discoverable by attackers.
Search results for title: PeopleSoft Sign-in
Criminal IP Search Query: title: PeopleSoft Sign-in
A more targeted search filtering specifically for exposed PeopleSoft authentication pages identifies the most directly exploitable subset of the broader result set. These are instances where the login interface — and by extension the vulnerable endpoints behind it — is directly reachable from the public internet without any network-level protection.
Based on this query, 84 PeopleSoft authentication interfaces were identified as publicly accessible as of June 2026. In the context of CVE-2026-35273, these represent the clearest and most immediate attack surface. Unauthenticated attackers can reach the vulnerable /PSEMHUB/ and /PSIGW/HttpListeningConnector endpoints directly through these exposed interfaces without any additional network traversal.
Potentially Exposed Assets in the US
Criminal IP Search Query: title: PeopleSoft country: US
The geographic distribution of exposed assets is particularly significant for this campaign. Security researchers confirmed that most breached organizations were based in the United States, with 68% operating within the higher education sector, which are universities and colleges whose PeopleSoft deployments manage student records, financial aid data, and staff personal information for tens of thousands of individuals per institution.
Filtering for US-based instances, 99 exposed PeopleSoft assets were identified within the United States. Of those, 10 are directly exposing their authentication login pages to the public internet, representing the most immediately exploitable targets in the dataset given the confirmed targeting of American educational institutions by ShinyHunters.
Security Risks of Publicly Exposed PeopleSoft Interfaces
An exposed PeopleSoft interface is far more than a visible login page. PeopleSoft is deeply integrated into organizational operations across human resources, finance, and academic administration, making a successful compromise significantly more damaging than a typical web application breach.
If attackers obtain access through CVE-2026-35273, several critical risks emerge:
Access to Sensitive Organizational Data PeopleSoft environments contain employee records, payroll data, financial transactions, student information, and healthcare data. Administrative access can expose vast amounts of personally identifiable information and confidential organizational data to exfiltration and ransom demands.
Lateral Movement Across Internal Systems Attackers use compromised PeopleSoft instances to map WebLogic configurations and move laterally across internal systems using stolen or hardcoded credentials, significantly expanding the scope of compromise beyond the initial entry point.
Persistence Through Webshell Deployment Threat actors have been observed deploying JSP webshell files in WebLogic application directories and modifying XML configuration files to maintain persistent access and trigger remote code execution after system restarts, meaning that even after the initial vulnerability is patched, compromised environments may remain under attacker control.
Disruption of Critical Operations PeopleSoft systems underpin payroll processing, financial reporting, student enrollment, and HR operations. Disruption of these systems through ransomware deployment or data destruction can cause severe operational and reputational damage.
Exposure of Internal Infrastructure PeopleSoft configurations contain internal hostnames, integration endpoints, storage paths, and authentication settings. Attackers can leverage this information to map internal environments and identify follow-on attack paths into connected systems.
Patch Status and Mitigation
Oracle has released emergency mitigations for CVE-2026-35273 while a full patch is being prepared. Organizations should not wait for the full patch before taking action. The following steps should be treated as immediate priorities:
- Verify whether PeopleTools versions 8.61 or 8.62 are in use across all environments including development, testing, and cloud deployments
- Immediately restrict external access to PeopleSoft endpoints, particularly /PSEMHUB/ and /PSIGW/HttpListeningConnector, through firewalls, VPNs, or access control policies
- Review server logs for suspicious requests targeting the vulnerable endpoints
- Inspect servers for indicators of compromise including unexpected JSP webshell files in WebLogic application directories, unauthorized files or binaries staged in PSEMHUB transaction folders, suspicious directories, and recently modified XML files
- Apply Oracle’s emergency mitigations immediately and monitor Oracle’s advisory for the forthcoming full patch
- If compromise is confirmed or suspected, engage Oracle support or a qualified incident response team, as patching over a compromised system does not remove attacker persistence.
FAQ
Q1. If a PeopleSoft interface is visible from the internet, does that mean it is vulnerable to CVE-2026-35273?
Not necessarily. Actual vulnerability depends on the PeopleTools version in use and whether emergency mitigations have been applied. However, publicly accessible PeopleSoft interfaces make it significantly easier for attackers to identify and target systems, making external exposure a critical risk factor regardless of patch status.
Q2. If our PeopleSoft system requires a login, are we safe?
Not necessarily. CVE-2026-35273 enables unauthenticated remote code execution, meaning attackers can exploit the vulnerability through backend integration endpoints without ever interacting with the login page. The presence of a login screen does not prevent exploitation.
Q3. We are in the education sector. Should we prioritize this?
Yes, immediately. Security researchers confirmed that 68% of breached organizations were in the higher education sector, making universities and colleges the primary target of active exploitation. Education sector organizations running PeopleTools 8.61 or 8.62 should treat this as a critical emergency.
Q4. What should organizations do first?
First, determine whether any PeopleSoft interfaces are publicly accessible from the internet. Then immediately restrict access to the vulnerable endpoints, apply Oracle’s emergency mitigations, and review logs and servers for indicators of compromise
Conclusion
CVE-2026-35273 demonstrates that enterprise application platforms, even those sitting behind corporate login pages can become critical attack surfaces when exposed to the public internet without proper network-level controls. The discovery of 468 publicly accessible Oracle PeopleSoft assets through Criminal IP Asset Search, including 93 directly exposing authentication interfaces and 99 US-based instances, shows that a significant number of PeopleSoft deployments remain visible and accessible to attackers on the public internet.
The confirmation by ShinyHunters that 300 instances across more than 100 organizations have already been breached using this vulnerability underscores the urgency of the situation. This does not mean all exposed assets identified here have been compromised. However, exposed PeopleSoft interfaces provide attackers with a direct starting point for exploitation, and given that no authentication is required to trigger CVE-2026-35273, the barrier to attack is exceptionally low.
Organizations should not limit their reviews to known production PeopleSoft servers. They must assess external exposure across all environments including cloud deployments, development systems, and legacy installations. Any PeopleSoft interface accessible from the public internet should be considered a priority remediation target regardless of confirmed vulnerability status. Attackers are already actively scanning and exploiting, so defenders must understand their attack surface before attackers do.
In relation to this, you can refer to SonicWall SSL-VPN MFA Bypass Vulnerability: The Attack Surface Between “Patched” and “Protected”
You can subscribe to Criminal IP (criminalip.io/register) and start detecting vulnerable assets right away. You can also request a demo using the button below and explore Criminal IP’s threat intelligence (TI) analysis of externally exposed assets at the enterprise level.
This report is based on data from Criminal IP, a Cyber Threat Intelligence search engine. Sign up for a free Criminal IP account today to explore the search results mentioned in the report and delve into comprehensive threat intelligence.
Source: Criminal IP(https://www.criminalip.io), BleepingComputer(https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/), Digital Today(https://www.digitaltoday.co.kr/en/view/62607/oracle-warns-of-peoplesoft-zero-day-flaw-hacking-group-claims-over-100-organisations-breached)
Related Article: https://www.criminalip.io/knowledge-hub/blog/34923