Oracle PeopleSoft CVE-2026-35273: ShinyHunters Breach

Oracle has closed the vulnerability behind one of the year’s largest enterprise-software breach campaigns. In its July 2026 Critical Patch Update, the company permanently fixed CVE-2026-35273, a critical flaw in PeopleSoft Enterprise PeopleTools that the extortion group ShinyHunters had exploited as a zero-day to compromise more than 100 organizations and roughly 300 PeopleSoft servers worldwide. The patch caps a saga that began quietly in late May, when a widely deployed HR and finance platform became the entry point for a mass data-theft operation that fell hardest on universities.

The vulnerability is a textbook example of how a single unauthenticated bug in enterprise middleware can cascade into an industry-wide incident. It required no login, no credentials, and no user interaction — just the ability to send a crafted request over the network.

What CVE-2026-35273 is

CVE-2026-35273 is a remote code execution vulnerability in PeopleSoft Enterprise PeopleTools, rated 9.8 out of 10 on the CVSS scale — the near-maximum severity reserved for flaws that are both trivially exploitable and catastrophic in impact. The root cause is unsafe deserialization of attacker-controlled data sent to the /PSEMHUB/hub endpoint, part of PeopleSoft’s Environment Management Hub (PSEMHUB).

Deserialization flaws are among the most dangerous classes of web vulnerability precisely because they turn untrusted input into executing code. When an application takes a serialized object from a request and reconstructs it without validation, an attacker can craft a payload that, once “rehydrated” by the server, runs commands of the attacker’s choosing. In this case, the endpoint accepted such input without any authentication, meaning anyone who could reach the server over HTTP could take it over. That combination — unauthenticated, remote, code execution — is the worst-case profile for a piece of software that sits at the center of an organization’s payroll, HR, and student-records systems.

Because PeopleSoft deployments are numerous and often internet-facing, the flaw functioned as a skeleton key. An attacker did not need to know anything about a specific target beyond the fact that it ran a vulnerable PeopleSoft instance. As our primer on zero-day vulnerabilities explains, a bug like this is at its most valuable in the window before a patch exists — and ShinyHunters used that window efficiently.

The zero-day window

The activity is dated between May 27 and June 9, 2026. Oracle did not publish its advisory until June 10, which means the vulnerability was a live zero-day for roughly two weeks — attackers were exploiting it in the wild before any fix or public warning existed. The flaw was serious enough that Oracle issued a rare out-of-band security alert on June 10, stepping outside its normal quarterly patch cadence, a move the company generally reserves for bugs it considers too urgent to hold.

During that two-week window, ShinyHunters ran automated scanning to find exposed, vulnerable PeopleSoft deployments at scale, then exploited them mechanically. This is the group’s signature approach: rather than crafting a bespoke attack against a single high-value target, it identifies one exploitable weakness in software that many organizations run and works methodically through the list. As of June 9, stolen data began appearing on the group’s leak site; by June 10, ShinyHunters claimed to have breached more than 100 organizations by compromising approximately 300 PeopleSoft instances.

The July Critical Patch Update that closed the chain was itself notable for its size. Oracle’s quarterly release addressed 1,455 newly disclosed vulnerabilities across its enterprise portfolio — one of the largest CPUs in the company’s history, landing in the same crowded patch cycle that produced Microsoft’s record July Patch Tuesday.

Education took the brunt

The campaign hit the higher-education sector disproportionately hard. By the count of responders tracking the incident, roughly 68 percent of the more than 100 notified organizations were universities and colleges. PeopleSoft is deeply entrenched in higher education, where it runs student-information systems, financial aid, HR, and payroll for institutions large and small — a concentration that gave a single exploit an outsized footprint across the sector.

The most prominent confirmed victim is the University of Nottingham, which publicly acknowledged the breach. Data on 454,600 current and former students — personal and academic records — was published on ShinyHunters’ leak site. That single institution’s exposure illustrates the stakes: student records typically bundle names, dates of birth, contact details, and academic history, a rich set for identity theft and targeted phishing that, once leaked, cannot be recalled.

The education sector’s exposure to this kind of campaign is structural. Institutions hold large volumes of sensitive personal data on students, staff, alumni, and donors, often across aging systems, while operating on leaner security budgets than the corporations that make bigger headlines. That pairing — valuable data behind thinner defenses — is precisely what a high-volume operator like ShinyHunters looks for.

Who ShinyHunters are

ShinyHunters is not a newcomer. The group has spent years running high-volume data-theft-and-extortion operations, and its victim list spans cloud services, SaaS platforms, and telecom providers. It has been tied to breaches involving Salesforce, Carnival, and Pitney Bowes, among others, and it typically exploits widely deployed enterprise software, misconfigurations, and stolen credentials rather than deploying sophisticated custom malware.

The operating model is “pay-or-leak” extortion, sometimes called double extortion: exfiltrate data quietly, then contact the victim with a demand — pay, or the data goes public. Notably, this model does not require encrypting a single file to be effective. The leverage is the threat of publication, and it is the same playbook the group ran in the recent Moody Bible Institute breach, where 2.3 million records were dumped after an extortion deadline passed. The PeopleSoft campaign is the same approach applied at platform scale: find one flaw in software that hundreds of organizations run, then harvest them in sequence.

That scale is what separates a supply-chain-style software flaw from an isolated breach. When the weakness lives in a common platform rather than in one company’s misconfiguration, every unpatched deployment is a potential victim, and the attacker’s marginal cost per additional target approaches zero.

What organizations should do

The immediate action is unambiguous: apply Oracle’s July Critical Patch Update to any PeopleSoft Enterprise PeopleTools deployment without delay. Any instance that was internet-facing between late May and mid-June should be treated as potentially compromised, not merely vulnerable — patching closes the door, but it does nothing about intruders who may already be inside or data already taken.

Beyond patching, defenders should:

• Hunt for compromise, not just missing patches. Review logs for anomalous requests to the /PSEMHUB/hub endpoint and for unexpected process execution, new accounts, or outbound data transfers during and after the exploitation window.
• Restrict exposure of PSEMHUB and other administrative endpoints. There is rarely a reason for the Environment Management Hub to be reachable from the open internet; network segmentation and access controls sharply reduce the attack surface.
• Rotate credentials and secrets that a compromised PeopleSoft server could have exposed, on the assumption that an attacker with code execution had access to whatever the server could reach.
• Prepare for downstream fraud. Organizations whose data was leaked should notify affected individuals and brace for a wave of targeted phishing and identity-theft attempts built on the stolen records — the same pattern seen after incidents like the Ernst & Young data exposure.

What it means

The PeopleSoft campaign is a clean illustration of a lesson the industry keeps relearning: the most dangerous vulnerabilities are not the ones in exotic software but the ones in the boring, ubiquitous systems that quietly run payroll, HR, and student records for thousands of organizations. A single unauthenticated deserialization bug turned a standard enterprise platform into a mass-compromise engine.

Who loses. The clearest losers are the roughly 100 breached organizations and the individuals whose records were taken — most of them students and staff at universities that will now spend months on breach notification, credit monitoring, and cleanup, with no way to recover data already on a leak site. Every institution still running an unpatched PeopleSoft instance is exposed to copycat exploitation now that the vulnerability is public.

Who is validated. Security teams that segment administrative endpoints, keep external attack surface minimal, and treat out-of-band vendor alerts as emergencies rather than routine came through this far better than those that left PSEMHUB reachable from the internet. The incident is an argument for defense-in-depth: patching speed matters, but so does making sure a single exploited service cannot reach everything else.

What to watch next. First, the pace of patching — the exploit is now well-documented, and unpatched deployments are sitting ducks for the broader criminal ecosystem, not just ShinyHunters. Second, further leaks, as the group works through its 100-plus victims and pressures the ones still negotiating. Third, regulatory fallout in the education sector, where breach-notification obligations and student-privacy rules will turn a security incident into a compliance one. The technical hole is closed; the human and legal aftermath of a two-week zero-day is only beginning.