Cyber ·
CVE-2026-35273: SSRF to RCE chain in Oracle PeopleSoft
Summary of a Zero Day Initiative advisory on a chain of SSRF and other flaws in Oracle PeopleSoft that can lead to remote code execution. The text reports ongoing mass exploitation attributed to the ShinyHunters group.
The advisory, carried in the Zero Day Initiative feed as an automatic translation, describes CVE-2026-35273. According to the text, the Zero Day Initiative reported the issue to Oracle on June 10, 2026. On September 25, 2026, Mandiant published a report on continuing mass exploitation of this CVE by the ShinyHunters group. Oracle released one fix under a single CVE, but the researchers say they found three distinct vulnerabilities across several PeopleSoft components and are coordinating with Oracle to assign separate CVEs. The two central components are the PeopleSoft Environment Management Hub, which implements the validateClient method to restrict access to functions, and the PeopleSoft Integration Gateway, which exchanges messages with remote systems through listening and target connectors. The first flaw is an SSRF in the Integration Gateway, identified as ZDI-CAN-31816. According to the text, an attacker can point the request at the loopback address, which satisfies the validation, and control both the URL accessed and the payload sent. That access would serve as a foothold to reach endpoints vulnerable to remote code execution. To verify, consult the Mandiant report and Oracle's security advisory, which list affected versions and fixes. Confirm the patch level of your environment and review logs for internal requests directed at the local address.
Original source: CVE-2026-35273: de SSRF a RCE no Oracle PeopleSoft