Zero-day in Oracle PeopleSoft drives ShinyHunters campaign: direct network exploitation and data filtration in higher education

The extortion campaign linked to the collective known as ShinyHunters - which Mandiant tracks as UNC6240 - has taken advantage of a critical vulnerability not patched in Oracle PeopleSoft to compromise servers, extract large volumes of data and pressure affected organizations to pay for silence. Between May 27 and June 9, the attackers exploded a remote execution failure in PeopleTools that does not require authentication or user interaction, making it a threat of direct exploitation from the network and therefore at immediate risk for facilities with Internet-accessible environment management.

The problem identified as CVE-2026-35273, with a score 9.8 / 10, is in the Updates Environment Management component behind the PSEMHUB (Environment Management Hub). Oracle noted that the PeopleTools 8.61 and 8.62 versions are affected and that old versions, even if they are no longer supported, are probably also affected. The appearance of active activity prior to the publication of the official notice confirms that it was a zero-day during the operating window, and that the response window was critical to avoid leaks.

Beyond technical exploitation, public research showed useful tactics and artifacts for detection and response: open servers left staging files exposed, a shared command history, remote management agents type MeshCentral camouflaged as Microsoft binaries and a SSH spread script that sprays internal credentials and leaves a marker file called README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in directories of PeopleSoft. The agents communicated with a domain designed to resemble a legitimate cloud service, which highlights the use of confidence lures by the attacker.

The most affected victim so far seems to be the university sector: Mandiant notified more than 100 organizations with vulnerable endpoints and estimated that the 68% of the partner addresses were higher education, many in America. The University of Nottingham confirmed an incident that has resulted in the publication of sensitive data - including passports and details on ethnicity and disabilities - and public verification services such as Have I Been Pwned They already count hundreds of thousands of emails in the filtered collections.

The immediate measures must be operational and pragmatic: if their deployment is multi-server, disable the service of the Environment Management Hub; if it is single-server, remove the PSEMHUB application. When that is not possible in hot, block external access to / PSEMHUB / *(special attention to / PSEMHUB / hub) and a / PSIGW / HttpListeningConnector on the perimeter. Oracle publishes its ads and patches through its security portal; see the official guide at Oracle Security Alerts and plan to apply the patch as soon as it is available in My Oracle Support.

Network containment alone is not enough: Mandiant warns that body inspection rules in WAF can be avoided, so it is necessary to combine perimeter block with internal controls. Look for detailed engagement signs in records and file system: POST requests outside the routes indicated, .jsp unexpected under PSEMHUB.war, suspicious folders called log, persistantstorage or scratchpad, recent changes in envmethadata / data / environment / * .xml that allow persistence via XMLDecoder, outgoing SMB traffic to external destinations (possible collection of NetNTLM hashes) and presence of the marker file left by the attackers.

At the level of response and mediation, isolate compromised servers and preserve evidence before cleaning; rotate all local and service credentials, apply multifactor authentication where possible, restrict and monitor internal SSH access (avoid shared passwords and hardcoded credentials), and effectively filtered output to block known command and control domains and destinations. Use file integrity detection and EDR tools to capture activity from unusual processes and connections, and consider a proactive search and mediation exercise in environments that do not show visible signs but share the same network exposure.

The regulatory and reputational risk implications are important: leaks with sensitive personal data (passports, information on disabilities or ethnicity) can activate reporting obligations under GDPR, state laws for reporting gaps in the US. EU or sectoral regulations. Notify the competent authorities, consult with legal advice on reporting obligations for victims, and prepare victim support procedures (fraud monitoring, freezing of accounts, etc.).

In strategic perspective, this incident shows two convergent trends: on the one hand, actors like ShinyHunters expand their repertoire to vulnerabilities in ERP on-premises, which often contain very sensitive data; on the other, organizations with legacy software and long parking cycles are easy targets if they leave management ports exposed. The lesson for administrators and CISUS is clear: to reduce public exposure of administrative interfaces, to speed up patching processes and to armored internal controls is now as critical as the protection of SaaS and cloud environments.

To keep informed and follow the technical publications of research officials, see sources of outreach such as the Zero Day Initiative of Trend (which participated in this report). ZDI and the official alerts of the supplier. If your organization operates PeopleSoft, treat this vulnerability as a priority, combine network mitigation with active sinking and prepare your incident response plan before applying production changes.