OracleExploited incident
Oracle PeopleSoft PeopleTools zero-day exploited by ShinyHunters (CVE-2026-35273)
CVE-2026-35273Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 12 Jun 2026
- Exploited before a fix
- Known ransomware use
Response
- Silence
- same day First public report to first vendor statement
- Exposure
- 6d First public report to first fix
- Follow-through
- 6d First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
BleepingComputer: Oracle PeopleSoft servers hacked in ShinyHunters data theft attacksCuratedQuote verified
June 10, 2026 02:31 PM
Byline time has no zone on the page; the page's JSON-LD gives datePublished 2026-06-10T14:31:57-04:00, i.e. 18:31 UTC. Article text: 'Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang'. BleepingComputer's 2026-06-11 follow-up says Oracle's disclosure 'comes after BleepingComputer first reported' the zero-day.
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:3593fa1c309f8afb…- Used in metrics
- Yes
6 more sources for this moment
Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot)CuratedQuote verified10 Jun 2026
2026-June-10 Rev 1. Initial Release.
Same day as the BleepingComputer report; which came first within the day is not known.
- Source
- Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:1cda34d6d51ba2b0…- Used in metrics
- No, kept for the record
CVE.org record CVE-2026-35273ClaimedQuote verified11 Jun 2026, 02:25 UTC
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily
CVE record published.
- Source
- CVE.org record CVE-2026-35273 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:f998f64b907c350e…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet11 Jun 2026, 03:02 UTC
＞Oracle Security Alert Advisory - CVE-2026-35273 www.oracle.com/security-ale...
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet11 Jun 2026, 19:54 UTC
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach 100 Orgs ShinyHunters, a notorious data theft group, claims to have exploited a critical Oracle PeopleSoft zero-day vulnerability,
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2026-35273)ClaimedQuote verified12 Jun 2026
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Added to CISA's KEV catalog on 2026-06-12.
- Source
- CISA KEV (CVE-2026-35273) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Research: gtiClaimedQuote verified25 Sep 2026
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Earliest mention we hold (a vetted outlet).
- Source
- Research: gti research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:1795a465fad9f52e…- Used in metrics
- No, kept for the record
Vendor statement
date onlysame day
Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot)CuratedQuote verified
2026-June-10 Rev 1. Initial Release.
Out-of-band Security Alert. Oracle's alert does not say the bug was exploited.
- Source
- Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:1cda34d6d51ba2b0…- Used in metrics
- Yes
First workaround
date onlysame day
Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot)CuratedQuote verified
We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action to address the identified exposure.
The alert (Rev 1, 2026-06-10, never revised as of the 2026-10-13 snapshot) offers 'Affected Products and Mitigation Information'; the mitigation details are in a My Oracle Support document behind login.
- Source
- Oracle Security Alert Advisory - CVE-2026-35273 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:1cda34d6d51ba2b0…- Used in metrics
- Yes
First fix
date only+6d
Oracle Critical Security Patch Update Advisory - June 2026 (Wayback snapshot)CuratedQuote verified
Customers are strongly advised to apply the June 2026 Critical Security Patch Update for Oracle PeopleSoft PeopleTools and Oracle PeopleSoft Enterprise Applications, which includes patches for this Alert as well as additional patches.
The June 2026 CSPU's Modification History reads '2026-June-16 Rev 1. Initial Release.' Secondary sources conflict on whether a patch existed earlier: Rapid7 (2026-06-12) says 'Oracle released an out-of-band patch the same day as the advisory' and Indusface says 'Oracle issued an out-of-band patch for CVE-2026-35273 on June 11', while BleepingComputer (2026-06-11) says Oracle 'has released emergency mitigations to address the flaw, with a patch coming soon' and The Register (2026-06-11) quotes Mandiant CTO Charles Carmakal: 'Oracle released mitigations ... Patches should come soon.' Oracle's own alert text speaks only of mitigations, so the earliest patch evidenced in Oracle's own words is this CSPU.
- Source
- Oracle Critical Security Patch Update Advisory - June 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:a94be2266e20282c…- Used in metrics
- Yes
Fixed for all versions
date only+6d
Oracle Critical Security Patch Update Advisory - June 2026 (Wayback snapshot)CuratedQuote verified
PeopleSoft Enterprise PT PeopleTools, versions 8.61, 8.62
The June 2026 CSPU (Rev 1, 2026-06-16) lists both supported affected PeopleTools versions.
- Source
- Oracle Critical Security Patch Update Advisory - June 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:a94be2266e20282c…- Used in metrics
- Yes
Send this to your boss
Oracle PeopleSoft PeopleTools flaw used in data theft; fixed in June 2026 update
Attackers used an unknown flaw in Oracle PeopleSoft PeopleTools 8.61 and 8.62 to break in without a password and steal data, starting about two weeks before Oracle published mitigations on June 10, 2026 and patches on June 16, 2026.
In plain words
Oracle PeopleSoft, the software many universities and companies use for HR, finance and student records, had a serious flaw that let attackers break in without a password. A criminal group used it to steal data from more than 100 organizations, starting in late May 2026, before any fix was available. Oracle published emergency mitigations on June 10, 2026 and the patches on June 16, 2026. If we run PeopleSoft, we need to confirm the June 2026 (or later) update is installed and check whether we were breached before it was applied.
What happened and who is affected
What happened
Between May 27 and June 9, 2026, the ShinyHunters extortion group used a then-unknown flaw (CVE-2026-35273, CVSS 9.8) to take over internet-facing PeopleSoft systems and steal data, mostly from universities, according to Google's Mandiant. Oracle published an emergency Security Alert with mitigations on June 10, 2026, and its June 16, 2026 Critical Security Patch Update includes the patches. CISA added the flaw to its exploited-vulnerabilities list on June 12, 2026.
Who is affected
Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62, including PeopleSoft Enterprise Applications (HR, finance, campus solutions) built on them, especially where the Environment Management Hub (/PSEMHUB/) or Integration Gateway (/PSIGW/HttpListeningConnector) is reachable from the internet.
Affected products
- Oracle PeopleSoft Enterprise PeopleTools 8.61, 8.62 (Updates Environment Management / PSEMHUB)
How we built this timeline
Zero-day: Mandiant (report of 11 Jun 2026, as summarised by Rapid7 and Tenable) observed exploitation between 27 May 2026 and 9 Jun 2026, attributed to UNC6240 (ShinyHunters); stolen data was posted to the ShinyHunters leak site on 9 Jun 2026 (per Rapid7) before any public report of the flaw. Reported to Oracle via TrendAI Zero Day Initiative.
First fix is conservative: see the First fix note for conflicting secondary claims of a 10 Jun 2026/11 out-of-band patch that Oracle's own pages do not state. The June 2026 CSPU also fixed CVE-2026-35278 (PeopleTools Performance Monitor, CVSS 9.8);
Indusface describes 35278 and 35273 as an exploited chain, but Oracle and Mandiant (as summarised) name only 35273, and 35278 is not in KEV, so it is not grouped here. ransomware=true follows KEV's knownRansomwareCampaignUse 'Known'; reporting describes data-theft extortion. oracle.com blocks non-browser user agents, so Wayback snapshots are cited.