Oracle PeopleSoft PeopleTools is a widely deployed Enterprise Resource Planning (ERP) platform used by universities,
hospitals, and government agencies worldwide to manage HR, payroll, and student records.
CVE-2026-35273 is a critical zero-day vulnerability in the PeopleTools Environment Management Hub (PSEMHUB) component,
allowing an unauthenticated remote attacker to achieve full OS-level code execution by chaining a Server-Side Request Forgery (SSRF)
through the PSIGW gateway with a Java XMLDecoder deserialization exploit inside the WebLogic JVM. Actively exploited in the wild by
the ShinyHunters threat group between May 27 and June 9, 2026 — prior to Oracle's emergency advisory — the attack compromised over 300
PeopleSoft installations across more than 100 organizations. Immediate mitigation includes applying Oracle's emergency patch or disabling
the PSEMHUB service, and restricting the /PSEMHUB and /PSIGW endpoints at the network perimeter.
The TA team is actively monitoring exploitation attempts and will deploy AIWAF detection patterns accordingly.
resources (HR), payroll, student information systems (SIS), and financial management. Thousands of universities, hospitals,
and government agencies around the world use PeopleSoft, and these systems concentrate large volumes of sensitive personal and
confidential data. Its core engine, PeopleTools, is the platform that underpins the development, deployment, and operation
of PeopleSoft applications, and it includes the Environment Management Hub (PSEMHUB) and the Integration Gateway (PSIGW) components.
CVE-2026-35273 is a critical zero-day vulnerability in PeopleTools versions 8.61 and 8.62, disclosed by Oracle in an emergency security advisory
on June 10, 2026. An attacker can access an internal-only servlet without authentication through SSRF (Server-Side Request Forgery, CWE-918)
in the PSIGW gateway, and then execute arbitrary code inside the WebLogic JVM using a Java XMLDecoder deserialization vulnerability.
This vulnerability is especially dangerous because Oracle’s existing serialization-filter hardening patch does not cover the XMLDecoder code path,
meaning the attack remains viable even in fully patched environments. It is rated 9.8 on the CVSS v3.1 scale (Critical) and represents a
top-level threat capable of pre-auth RCE.
Source: https://www.oracle.com/applications/peoplesoft/
the PSIGW gateway and PSEMHUB. CWE-918 (Server-Side Request Forgery) is the entry point of the attack, and unsafe deserialization
in Java XMLDecoder leads to OS-level privilege acquisition.
STEP 1 — Reconnaissance
The attacker scans PeopleSoft serves exposed to the internet using tools such as Shodan and Censys.
Servers with an unauthenticated /PSEMHUB/hub endpoint are selected as primary targets.
STEP 2 — Internal servlet access via SSRF (authentication bypass)
The attacker exploits an SSRF vulnerability in the PSIGW (PeopleSoft Integration Gateway) to forge requests to an internal management
servlet that cannot be accessed directly from the outside, such as /PSIGW/HttpListeningConnector.
This bypasses the perimeter authentication layer.
STEP 3 — Java XMLDecoder deserialization payload delivery
After gaining access to the internal servlet, the attacker delivers a malicious XML payload to Java XMLDecoder.
Because Oracle’s existing serialization filter does not cover this code path, the filter is bypassed and arbitrary Java code is executed inside the WebLogic JVM.
STEP 4 — Pre-auth RCE and persistence
The payload executed inside the JVM gains OS-level command execution privileges.
The attacker may then perform post-exploitation actions such as uploading web shells, installing backdoors, or, in Windows environments,
forcing SMB connections to steal NetNTLM hashes. Because execution occurs inside the JVM without spawning a child process, detection
by traditional EDR/SIEM tools is difficult.
STEP 5 — Data theft and impact expansion
Between May 27 and June 9, 2026, the ShinyHunters threat group (UNC6240) compromised more than 300 PeopleSoft installations
before Oracle’s advisory was released, stealing HR, payroll, and student records from universities, hospitals, and government agencies.
The stolen data was published on the ShinyHunters data leak site (DLS), and additional ransomware threat activity has also been observed.
3. Response
so immediate action is required.
Oracle PeopleSoft components used by organizations handling sensitive data, such as universities, hospitals, and government agencies.
The multi-stage attack chain combining SSRF and Java deserialization bypasses existing serialization filters and uses in-JVM execution to
evade EDR detection. Since more than 300 installations have already been compromised by the ShinyHunters group and large volumes of
personal data have been leaked, unpatched systems face a high risk of further ransomware-related damage.
A PoC has already been publicly disclosed, and it is expected that the vulnerability will be rapidly weaponized into automated attack tools.
All organizations operating PeopleSoft should prioritize immediate PSEMHUB deactivation and emergency patching.
Our TA team is closely monitoring SSRF and Java deserialization attack patterns targeting Oracle PeopleSoft vulnerabilities, and we will immediately
update AIWAF detection and blocking patterns for abnormal access to the /PSEMHUB and /PSIGW endpoints.
hospitals, and government agencies worldwide to manage HR, payroll, and student records.
CVE-2026-35273 is a critical zero-day vulnerability in the PeopleTools Environment Management Hub (PSEMHUB) component,
allowing an unauthenticated remote attacker to achieve full OS-level code execution by chaining a Server-Side Request Forgery (SSRF)
through the PSIGW gateway with a Java XMLDecoder deserialization exploit inside the WebLogic JVM. Actively exploited in the wild by
the ShinyHunters threat group between May 27 and June 9, 2026 — prior to Oracle's emergency advisory — the attack compromised over 300
PeopleSoft installations across more than 100 organizations. Immediate mitigation includes applying Oracle's emergency patch or disabling
the PSEMHUB service, and restricting the /PSEMHUB and /PSIGW endpoints at the network perimeter.
The TA team is actively monitoring exploitation attempts and will deploy AIWAF detection patterns accordingly.
1. Overview
Oracle PeopleSoft is an ERP software suite developed and supplied by Oracle that handles core business functions such as humanresources (HR), payroll, student information systems (SIS), and financial management. Thousands of universities, hospitals,
and government agencies around the world use PeopleSoft, and these systems concentrate large volumes of sensitive personal and
confidential data. Its core engine, PeopleTools, is the platform that underpins the development, deployment, and operation
of PeopleSoft applications, and it includes the Environment Management Hub (PSEMHUB) and the Integration Gateway (PSIGW) components.
CVE-2026-35273 is a critical zero-day vulnerability in PeopleTools versions 8.61 and 8.62, disclosed by Oracle in an emergency security advisory
on June 10, 2026. An attacker can access an internal-only servlet without authentication through SSRF (Server-Side Request Forgery, CWE-918)
in the PSIGW gateway, and then execute arbitrary code inside the WebLogic JVM using a Java XMLDecoder deserialization vulnerability.
This vulnerability is especially dangerous because Oracle’s existing serialization-filter hardening patch does not cover the XMLDecoder code path,
meaning the attack remains viable even in fully patched environments. It is rated 9.8 on the CVSS v3.1 scale (Critical) and represents a
top-level threat capable of pre-auth RCE.
Source: https://www.oracle.com/applications/peoplesoft/
2. Attack Type
CVE-2026-35273 is a multi-stage, pre-authentication RCE chain that exploits two components of the PeopleSoft architecture in sequence:the PSIGW gateway and PSEMHUB. CWE-918 (Server-Side Request Forgery) is the entry point of the attack, and unsafe deserialization
in Java XMLDecoder leads to OS-level privilege acquisition.
STEP 1 — Reconnaissance
The attacker scans PeopleSoft serves exposed to the internet using tools such as Shodan and Censys.
Servers with an unauthenticated /PSEMHUB/hub endpoint are selected as primary targets.
STEP 2 — Internal servlet access via SSRF (authentication bypass)
The attacker exploits an SSRF vulnerability in the PSIGW (PeopleSoft Integration Gateway) to forge requests to an internal management
servlet that cannot be accessed directly from the outside, such as /PSIGW/HttpListeningConnector.
This bypasses the perimeter authentication layer.
STEP 3 — Java XMLDecoder deserialization payload delivery
After gaining access to the internal servlet, the attacker delivers a malicious XML payload to Java XMLDecoder.
Because Oracle’s existing serialization filter does not cover this code path, the filter is bypassed and arbitrary Java code is executed inside the WebLogic JVM.
STEP 4 — Pre-auth RCE and persistence
The payload executed inside the JVM gains OS-level command execution privileges.
The attacker may then perform post-exploitation actions such as uploading web shells, installing backdoors, or, in Windows environments,
forcing SMB connections to steal NetNTLM hashes. Because execution occurs inside the JVM without spawning a child process, detection
by traditional EDR/SIEM tools is difficult.
STEP 5 — Data theft and impact expansion
Between May 27 and June 9, 2026, the ShinyHunters threat group (UNC6240) compromised more than 300 PeopleSoft installations
before Oracle’s advisory was released, stealing HR, payroll, and student records from universities, hospitals, and government agencies.
The stolen data was published on the ShinyHunters data leak site (DLS), and additional ransomware threat activity has also been observed.
3. Response
so immediate action is required.
Immediate patching and upgrading
Apply Oracle’s emergency security patch immediately. Do not wait for the regular patch cycle; prioritize the emergency update.
- PeopleTools 8.61: Apply the latest emergency patch (Oracle Security Alert CVE-2026-35273).
- PeopleTools 8.62: Apply the latest emergency patch.
- Immediate application is recommended regardless of the Oracle Critical Patch Update (CPU) schedule.
Temporary mitigations
Until patching is complete, reduce the attack surface immediately with the following measures.
- Multi-server configuration: Disable the PSEMHUB (Environment Management Hub) service immediately.
- Single-server configuration: Remove the PSEMHUB application.
- Block external access to /PSEMHUB/hub and /PSIGW/HttpListeningConnector through firewall and ACL rules.
- Block outbound SMB (TCP 445) connections from PeopleSoft servers to prevent NetNTLM hash theft.
- Immediately verify whether the WebLogic administration console is exposed externally.
AIWAF response
- Pattern response: CVE-2026-35273 is structurally similar to Apache Struts Framework OGNL-based RCE vulnerabilities in that it uses Java XMLDecoder deserialization for remote code execution.
The Apache Struts Framework Vulnerability detection patterns currently applied in AIWAF are being used to detect and block malicious XML deserialization payloads and Java code execution attempts reaching /PSIGW/HttpListeningConnector.
- False-positive prevention: Normal PSIGW communication between internal PeopleSoft systems originates from trusted internal IP ranges, so internal source IPs are managed through a whitelist to avoid false positives.
4. Conclusion
CVE-2026-35273 is a critical zero-day vulnerability that can allow unauthenticated attackers to fully compromise coreOracle PeopleSoft components used by organizations handling sensitive data, such as universities, hospitals, and government agencies.
The multi-stage attack chain combining SSRF and Java deserialization bypasses existing serialization filters and uses in-JVM execution to
evade EDR detection. Since more than 300 installations have already been compromised by the ShinyHunters group and large volumes of
personal data have been leaked, unpatched systems face a high risk of further ransomware-related damage.
A PoC has already been publicly disclosed, and it is expected that the vulnerability will be rapidly weaponized into automated attack tools.
All organizations operating PeopleSoft should prioritize immediate PSEMHUB deactivation and emergency patching.
Our TA team is closely monitoring SSRF and Java deserialization attack patterns targeting Oracle PeopleSoft vulnerabilities, and we will immediately
update AIWAF detection and blocking patterns for abnormal access to the /PSEMHUB and /PSIGW endpoints.
5. Reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-35273
- https://www.oracle.com/security-alerts/alert-cve-2026-35273.html (Oracle Security Alert)
- https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/ (Rapid7 ETR)
- https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html (Trend Micro 기술 분석)
- https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html (The Hacker News)
