Oracle PeopleSoft CVE Was Three Chained Flaws, ZDI Shows

When Oracle patched CVE-2026-35273 in June, the advisory described it as a missing-authentication flaw in PeopleSoft that let unauthenticated attackers gain full system control. That is accurate. It is also the simplified version.

Bobby Gould at the Zero Day Initiative disclosed this week that what Oracle shipped under one CVE ID is actually three distinct vulnerabilities chained together. The chain starts with a server-side request forgery (SSRF) in PeopleSoft’s Integration Gateway component (PSIGW), then passes through a configuration trust bypass: allowedhosts.properties accepts 127.0.0.1 by default, so a loopback address forged via the SSRF is treated as a trusted source. From there, an attacker can reach remote code execution through one of two routes: writing malicious log files to plant web shells, or sending a crafted XML payload to Java’s XMLDecoder class. Oracle has issued separate CVE assignments for all three components; ZDI coordinated the full disclosure.

The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Oracle’s out-of-band patch arrived on June 10, 2026, roughly two weeks after ShinyHunters (tracked by Mandiant as UNC6240) had already begun exploiting it as a zero-day. The initial campaign ran May 27 to June 9 and targeted universities. By September, Mandiant reported a second and broader wave across multiple sectors. Some organizations in that window deployed WAF rules as a compensating control rather than applying the patch, and ShinyHunters bypassed those using URL encoding. Google’s Threat Intelligence Group confirmed the group had retooled the exploit before the September resurgence.

The three-flaw framing matters in incident response, even now. A web shell planted via the log-file write route and a backdoor installed through the XMLDecoder path are different artifacts. An investigation that searched only for the SSRF entry point could miss a second-stage payload left by a different method. Any organization exposed during the zero-day window should verify that both persistence mechanisms were checked.

The configuration default in allowedhosts.properties is also worth examining independently. Oracle’s patch addresses the SSRF, but a future SSRF in a different PeopleSoft component could route through the same loopback trust. Reviewing that default is a reasonable hardening step regardless of patch status.

Oracle’s security alert for CVE-2026-35273 covers the remediation path for PeopleTools 8.61 and 8.62. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog with a June 15 federal deadline; known ransomware use is confirmed. The CVE-2026-35273 entry on this site has the full technical profile. For anything still unpatched in this codebase, the exploitation window has been open since May.