Oracle Patches PeopleSoft Security Vulnerability
The patch resolves three chained vulnerabilities that attackers leveraged to gain unauthorized access starting in May 2026.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust that major software companies are transparent about security vulnerabilities in their products?
Oracle issued a patch in June 2026 for three chained vulnerabilities in its PeopleSoft software that were exploited by ShinyHunters. The security flaw, identified as CVE-2026-35273, was actively leveraged by the group starting in May 2026.
Why it matters
The exploitation highlights the risks posed by chained vulnerabilities that bypass internal trust boundaries. By securing the management interface, the patch closes a path that allowed attackers to gain unauthorized access by masquerading as internal traffic.
The vulnerability involves three chained flaws under CVE-2026-35273, centered on a server-side request forgery (SSRF). This SSRF allows external entities to bypass security checks by accessing an internal management interface that the software incorrectly trusts via its own loopback address.
The players
Oracle
A global enterprise software company known for its database management systems and the PeopleSoft suite for human resource and financial management.
ShinyHunters
A well-known cybercriminal collective recognized for exfiltrating and selling large databases from various corporate and government targets.
The details
The flaw functions through server-side request forgery (SSRF) — a security vulnerability that allows an attacker to induce a server to make requests to unintended locations. By exploiting this, unauthorized users accessed internal management interfaces that PeopleSoft systems typically permit because they trust requests originating from their own loopback address, or internal local host interface. Chaining these three vulnerabilities allowed for an escalation of privilege that bypassed standard perimeter protections.
Timeline
May 2026: ShinyHunters began exploiting the vulnerabilities in PeopleSoft.
June 2026: Oracle issued a patch for the three vulnerabilities.
The Tech Race
This incident follows a pattern set by the 2020 SolarWinds Orion supply chain attack, where attackers exploited deep-seated trust within enterprise software environments. It marks a departure from simple credential theft, demonstrating the increasing sophistication of chaining minor flaws to bypass hardened perimeters.
Organizations running Oracle PeopleSoft should confirm their installations are updated to the June 2026 patch to mitigate risks associated with CVE-2026-35273. System administrators must verify that internal management interfaces are restricted and no longer trust loopback requests from external-facing services.
The takeaway
The event serves as a reminder to audit internal network trust boundaries within legacy enterprise software architectures. Organizations should monitor security bulletins for CVE-2026-35273 to ensure all instances are updated, as the chained nature of these flaws increases the complexity of exploitation.
Further reading
For broader trends in enterprise security, browse the Cybersecurity section.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you trust that major software companies are transparent about security vulnerabilities in their products?
