ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that
Brief summary
What this story is about
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that
Why it matters
Reader takeaways
- Prioritize whether the item affects internet-facing systems, databases, middleware, or identity infrastructure.
- Map the source item to your next patch window and document owners before remediation starts.
- Keep the original advisory link because patch details can change after publication.
SEO context
Topic and keyword map
This brief is filed under Oracle security alerts and Critical Patch Update watch.
CVEOracle Critical Patch UpdateOracle security alertsOracle CVEDBA patchingsecurity advisories