ShinyHunters Exploited an Oracle PeopleSoft Zero-Day for Two Weeks Before Disclosure as CVE-2026-35273 Lands on CISA's KEV Catalog

Overview

A critical flaw in Oracle PeopleSoft Enterprise PeopleTools was exploited in the wild for roughly two weeks before the vendor disclosed it, and the U.S. Cybersecurity and Infrastructure Security Agency has since added it to its Known Exploited Vulnerabilities catalog. According to the NVD, CVE-2026-35273 carries a base score of 9.8 CRITICAL and is classified as CWE-306, “Missing Authentication for Critical Function.” The same record places the CISA KEV date added at 06/12/2026 and a remediation due date of 06/15/2026.

What We Know

The vulnerability sits in the Environment Management component of PeopleSoft Enterprise PeopleTools. The NVD describes it as a flaw in the “Updates Environment Management component” that an “unauthenticated attacker with network access via HTTP can exploit,” potentially resulting in complete system compromise across confidentiality, integrity, and availability. Help Net Security identifies the affected service more specifically as the Environment Management Hub (PSEMHUB).

The NVD assigns the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a network-accessible, low-complexity attack that requires no privileges and no user interaction, according to the NVD record. Rapid7 reports that the bug is “remotely exploitable without authentication” and that successful exploitation “may result in remote code execution (RCE).”

PeopleTools versions 8.61 and 8.62 are affected, per Rapid7. Security Affairs adds that those two versions are confirmed affected and that Oracle says earlier, unsupported versions are likely vulnerable as well.

The exploitation predated the vendor advisory. Rapid7 dates the activity to “between May 27 and June 9, 2026, predating Oracle’s advisory by two weeks,” and attributes the campaign to “UNC6240 (ShinyHunters), a financially motivated cybercriminal collective” tracked by Mandiant. Security Affairs likewise ties the zero-day exploitation to UNC6240, also tracked as ShinyHunters.

The campaign appears to have leaned heavily toward the education sector. The attackers claimed to have targeted 300 PeopleSoft instances belonging to more than 100 organizations, according to SecurityWeek, which says the education sector was reportedly hit hardest. BleepingComputer reports that Mandiant found most of the affected organizations were based in the United States and that 68 percent operated within the higher education sector.

Oracle issued an out-of-cycle alert on June 10, 2026, according to Help Net Security, which reports there was “no patch available” at that point and that Oracle’s guidance was to disable the Environment Management Hub service or block external access to the affected endpoints at the network perimeter. SecurityWeek similarly notes that “it appears that only mitigations have been released by Oracle rather than a full patch.” BleepingComputer reports that Oracle “released emergency mitigations to address the flaw, with a patch coming soon.”

CISA’s listing triggers a binding federal deadline. The NVD records a remediation due date of June 15, 2026, and Security Affairs reports the same June 15, 2026 federal remediation deadline, three days after the June 12 KEV addition.

What We Don’t Know

The full scope of data theft remains unconfirmed by Oracle. SecurityWeek notes that Oracle has not officially confirmed zero-day exploitation in its public advisory, even though external researchers and threat-intelligence teams have documented it. The same report quotes the Zero Day Initiative’s Dustin Childs as saying, “Currently, we’re seeing limited exploitation, but our investigation is ongoing,” indicating that the true breadth of compromise is still being assessed.

It is also unclear when a full patch will replace the interim mitigations, and whether unsupported PeopleTools releases that Oracle flagged as likely vulnerable will receive fixes at all.

Analysis

The pattern here is familiar: a network-reachable management component with missing authentication, exploited quietly as a zero-day for weeks before any public advisory, then formalized into a binding federal patch order once detection caught up. The unusually short three-day window between the June 12 KEV addition and the June 15 deadline, per the NVD record, underscores how CISA treats actively exploited, unauthenticated remote-takeover bugs in enterprise back-office software. With mitigations rather than a full patch available at disclosure, organizations running PeopleTools 8.61 or 8.62 face a narrow choice between disabling the Environment Management Hub and exposing it to a campaign already attributed to a financially motivated extortion group.