A critical vulnerability in Oracle PeopleSoft is being exploited by ShinyHunters, a cybercriminal group known for stealing data and using it to pressure organisations into paying.
The vulnerability, tracked as CVE-2026-35273, could allow attackers to take control of affected servers without logging in. The group has used this flaw to gain access to organisations' systems and steal sensitive information.
Recent threat intelligence also shows that attackers have modified their techniques to bypass some security controls designed to block these attacks.
What is the Vulnerability?
Oracle PeopleSoft is business software used by organisations to manage operations such as human resources, payroll and financial records.
The vulnerability allows attackers to exploit weaknesses in the software to gain unauthorised access and run malicious commands on affected servers.
In simple terms, an attacker may be able to take control of a vulnerable server without needing a username or password.
Who Is At Risk?
Organisations using Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected.
The risk is particularly important for organisations that use PeopleSoft to store or process sensitive employee, financial, student or business information.
Although attacks have been reported across several sectors globally, all organisations running affected systems should assess their exposure.
What Is The Potential Impact?
Successful exploitation could lead to:
- Data breaches: Theft of sensitive business, employee or customer information.
- Financial and operational disruption: Unauthorised access to systems supporting essential business activities.
- Credential theft: Exposure of passwords and other sensitive access details stored on affected systems.
- Data extortion: Threats to publish stolen information unless the organisation pays.
- Further compromise: Attackers using the affected server as a starting point to access other systems.
Recommendations
Organisations should take the following steps:
- Apply the security patch: Install Oracle's update for CVE-2026-35273 immediately.
- Restrict access: Prevent public access to sensitive PeopleSoft management interfaces.
- Check for compromise: Review system logs for suspicious activity and inspect affected servers for unauthorised files or tools.
- Secure credentials: If compromise is suspected, change credentials that may have been exposed and investigate potentially affected accounts.
- Review security controls: Do not rely solely on firewall or web application firewall rules to protect unpatched systems.
esentry's Security Perspective
This incident highlights how an unpatched vulnerability can expose an organisation to data theft and extortion, even when security controls are in place.
As a Managed Security Services Provider (MSSP),we recommends that organisations combine timely patching with continuous threat monitoring, vulnerability management and regular reviews of internet-facing systems.
The priority is clear: patch affected systems, investigate suspicious activity and protect sensitive business data before attackers gain access.
.jpeg)
.png)
.png)
.png)