CVE-2026-35273: Oracle PeopleSoft RCE Zero-Day Explained

Umut Bayram | 5 MIN READ

| July 03, 2026

Key Takeaways

CVE-2026-35273 is a critical, unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools with a 9.8 CVSS score.
The root cause is unsafe deserialization of attacker-controlled data sent to the /PSEMHUB/hub endpoint without any authentication.
Financially motivated extortion group UNC6240, known as ShinyHunters, exploited the flaw and heavily targeted the higher education sector.
PeopleTools 8.61 and 8.62 are the confirmed affected versions, and the flaw is listed in the CISA KEV catalog.
The Picus Platform lets organizations simulate CVE-2026-35273 attacks to test the effectiveness of their security controls.

CVE-2026-35273 is a critical, unauthenticated remote code execution vulnerability in Oracle PeopleSoft Enterprise PeopleTools that carries a CVSS score of 9.8.

It was exploited in the wild as a zero-day before Oracle released a patch, and it has already been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. If you run PeopleTools 8.61 or 8.62 with an internet-reachable Environment Management Hub, you should treat this as an emergency.

This post breaks down what the vulnerability is, what causes it at the code level, how attackers exploit it, how to tell if you are exposed, and how to fix it.

What Is Oracle PeopleSoft and PeopleTools?

Oracle PeopleSoft is an enterprise business application suite used by large organizations to run core operations such as human resources, payroll, finance, supply chain, procurement, and student administration. It is especially common in higher education, government, and large enterprises, where it often holds sensitive personal and financial records.

PeopleTools is the underlying development and runtime platform that every PeopleSoft application is built on. It provides the application server, the web layer known as PeopleSoft Internet Architecture (PIA), the Integration Gateway, and the administration tooling that keeps an environment running.

The vulnerable component in this case is part of PeopleSoft Environment Management Hub (PSEMHUB). Two endpoints matter for this vulnerability:

/PSEMHUB/hub, the Environment Management Hub endpoint.
/PSIGW/HttpListeningConnector, an Integration Gateway listening connector under the /PSIGW/ path.

Both are often exposed to the network and, in vulnerable configurations, both can be reached without authentication.

What Is CVE-2026-35273?

CVE-2026-35273 is a pre-authentication remote code execution vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools.

An unauthenticated attacker with network access over HTTP can send a crafted request to the PSEMHUB hub endpoint and ultimately execute arbitrary code on the server, leading to complete takeover of the PeopleSoft instance.

The flaw was exploited in the wild as a zero-day, with attacks running from May 27 to June 9, 2026, roughly two weeks before the advisory [1].

Who Is Exploiting CVE-2026-35273?

The campaign exploiting this vulnerability has been attributed to a financially motivated extortion group tracked as UNC6240, publicly known as ShinyHunters.

The activity heavily targeted the higher education sector, with universities and colleges making up the large majority of the more than 100 notified organizations. Stolen data was published on the group's data leak site, and victims received extortion demands.

How Does CVE-2026-35273 Work?

At the heart of the vulnerability is unsafe deserialization of attacker-controlled data. The /PSEMHUB/hub endpoint accepts an HTTP POST containing an OPERATION parameter. In vulnerable versions, the value of that parameter is treated as a serialized Java object and is deserialized by the server before any authentication takes place.

During deserialization, attacker-chosen classes that already exist on the server classpath can be coerced into performing unintended actions. By chaining together the side effects of these classes, an attacker builds a "gadget chain" that drives the server toward a desired outcome, including command execution.

This vulnerability can be validated using the following Nuclei detection template [2]:

POST /PSEMHUB/hub HTTP/1.1

Host: <Hostname>

Content-Type: application/x-www-form-urlencoded

OPERATION=<generate_java_gadget("dns", "http://interactsh-url", "base64")>

It sends a single POST to /PSEMHUB/hub carrying a benign DNS gadget in the OPERATION parameter, then confirms a hit when the server triggers an out-of-band DNS callback.

The second endpoint, /PSIGW/HttpListeningConnector, is a PeopleSoft Integration Gateway connector abused as an SSRF link to reach internal services. Within the chain, this SSRF becomes the path that turns server access into remote code execution [3].

Am I Affected by CVE-2026-35273?

You should assume you are at risk and investigate immediately if any of the following are true:

You run PeopleTools 8.61 or 8.62. These are the confirmed affected versions.
Your PSEMHUB endpoint (/PSEMHUB/hub) or Integration Gateway connector (/PSIGW/HttpListeningConnector) is reachable from untrusted networks.
You have not yet applied Oracle's out-of-band patch from June 10, 2026.

Because exploitation began as a zero-day on May 27, 2026, patching alone does not tell you whether you were already breached. You should also hunt for the indicators of compromise after patching.

How to Mitigate and Remediate CVE-2026-35273

For remediation, apply Oracle's out-of-band patch for CVE-2026-35273 immediately. Because attackers could have breached your environment before you patched, also hunt for indicators of compromise.

If you cannot patch instantly, apply these controls:

Restrict external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the firewall or network edge.
Alert on outbound SMB traffic from PeopleSoft servers to untrusted external destinations.
Disable the Environment Management Hub (EMHub) service, or remove the PSEMHUB application entirely if your environment can run without it.

How Picus Simulates CVE-2026-35273 Attacks?

We also strongly suggest simulating CVE-2026-35273 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2026-35273 attacks:

Threat ID	Threat Name	Attack Module
69686	Oracle PeopleSoft Web Attack Campaign	Web Application

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit,” Google Cloud Blog. Accessed: Jun. 30, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit

[2] “nuclei-templates/http/cves/2026/CVE-2026-35273.yaml at 18078f1cadacef2bd905ad1f59a23293315b9d3c · projectdiscovery/nuclei-templates,” GitHub. Accessed: Jun. 30, 2026. [Online]. Available: https://github.com/projectdiscovery/nuclei-templates/blob/18078f1cadacef2bd905ad1f59a23293315b9d3c/http/cves/2026/CVE-2026-35273.yaml

[3] J. Burgess, “Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273),” Rapid7. Accessed: Jun. 30, 2026. [Online]. Available: https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/

CVE-2026-35273 is a pre-authentication remote code execution vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. It carries a critical CVSS score of 9.8. An unauthenticated attacker with HTTP network access can send a crafted request to the PSEMHUB hub endpoint and execute arbitrary code, leading to complete takeover of the PeopleSoft instance.

The vulnerability stems from unsafe deserialization of attacker-controlled data. The /PSEMHUB/hub endpoint accepts an HTTP POST with an OPERATION parameter, whose value is deserialized as a Java object before authentication. Attackers chain existing classpath classes into a gadget chain to drive command execution, while /PSIGW/HttpListeningConnector is abused as an SSRF link to reach internal services.

PeopleTools 8.61 and 8.62 are the confirmed affected versions. Organizations are at risk if their PSEMHUB endpoint or Integration Gateway connector is reachable from untrusted networks, or if Oracle's out-of-band patch from June 10, 2026, has not yet been applied. Because exploitation began as a zero-day, patching alone does not confirm safety.

Yes. The flaw was exploited as a zero-day, with attacks running from May 27 to June 9, 2026, roughly two weeks before the advisory. The campaign was attributed to a financially motivated extortion group tracked as UNC6240, publicly known as ShinyHunters, which heavily targeted the higher education sector and issued extortion demands.

Assume you are at risk if you run PeopleTools 8.61 or 8.62, which are the confirmed affected versions. You are also exposed if your PSEMHUB endpoint or Integration Gateway connector is reachable from untrusted networks, or if Oracle's out-of-band patch from June 10, 2026 has not been applied. Because you could have already been breached, also hunt for indicators of compromise after patching.

The Picus Platform lets organizations simulate CVE-2026-35273 attacks to test the effectiveness of their security controls against real-life cyber attacks. The Picus Threat Library includes the Oracle PeopleSoft Web Attack Campaign threat for this vulnerability.