Oracle PeopleSoft zero-day reportedly exploited by ShinyHunters since May

Summary

The Register reports new analysis indicating that an Oracle PeopleSoft zero-day involves three distinct vulnerabilities that can be combined to achieve remote code execution. The item states the flaw was exploited by ShinyHunters as early as May.

If you use Oracle

Apply Oracle's security patches for PeopleSoft as soon as they are available

Review PeopleSoft and related server logs back to May for suspicious activity

Restrict network access to PeopleSoft servers and limit exposure to the internet

Monitor Oracle security advisories for updates and official confirmation

Apply Oracle's patch for CVE-2026-35273 to PeopleSoft

Review PeopleSoft logs for server-side request forgery and unexpected outbound connections

What the sources say 9

Oct 28, 2026, 7:31 PM UTC · Mastodon: “ZDI says three PeopleSoft flaws were patched under CVE-2026-35273.” Source

Oct 29, 2026, 1:05 PM UTC · Bluesky: “New analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE.” Source

Oct 29, 2026, 5:49 PM UTC · Bluesky: “Attackers are still probing a critical E-Business Suite vulnerability despite a patch, while the PeopleSoft zero-day exploited by ShinyHunters is actually three distinct bugs.” Source

Oct 29, 2026, 7:25 PM UTC · Bluesky: “New research from Zero Day Initiative found that the actively exploited PeopleSoft vulnerability, CVE-2026-35273, actually encompasses three distinct vulnerabilities that attackers can chain together....” Source

Oct 30, 2026, 8:07 PM UTC · Mastodon: “Vulnerability in Oracle REST Data Services (component: Core).” Source

Oct 30, 2026, 8:07 PM UTC · Mastodon: “Vulnerability in Oracle REST Data Services (component: Graph QL).” Source

Oct 30, 2026, 8:07 PM UTC · Mastodon: “Vulnerability in Oracle REST Data Services (component: Database Actions).” Source