As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
CVE-2026-35273 is a critical server-side request forgery (SSRF) vulnerability in Oracle PeopleSoft that allows remote code execution (RCE) through a chain of three distinct flaws in the Integration Gateway and Environment Management Hub components. Mandiant reported mass exploitation by the ShinyHunters group following initial disclosure by TrendAI on June 10, 2026. Attackers can exploit the SSRF to bypass access controls, write malicious files to execute code, or deserialize untrusted XML to gain control of PeopleSoft instances.
Why it matters: Organizations running Oracle PeopleSoft must patch immediately, as this CVSS 9.8 vulnerability is actively exploited and listed in CISA's known exploited vulnerabilities catalog, allowing unauthenticated remote code execution in the context of the PeopleSoft service account.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
CVE-2026-35273 is a critical server-side request forgery (SSRF) vulnerability in Oracle PeopleSoft that allows remote code execution (RCE) through a chain of three distinct flaws in the Integration Gateway and Environment Management Hub components. Mandiant reported mass exploitation by the ShinyHunters group following initial disclosure by TrendAI on June 10, 2026. Attackers can exploit the SSRF to bypass access controls, write malicious files to execute code, or deserialize untrusted XML to gain control of PeopleSoft instances.
Why it matters: Organizations running Oracle PeopleSoft must patch immediately, as this CVSS 9.8 vulnerability is actively exploited and listed in CISA's known exploited vulnerabilities catalog, allowing unauthenticated remote code execution in the context of the PeopleSoft service account.
- Source published
- First seen by Cybersecurity Tracker