The critical Oracle PeopleSoft vulnerability that has been exploited in a mass campaign is not one bug but three, according to a detailed technical disclosure published by TrendAI’s Zero Day Initiative. The breakdown reveals how an unauthenticated attacker can chain a server-side request forgery, an arbitrary file write, and a Java deserialization flaw to achieve full remote code execution on affected PeopleSoft systems.
Oracle patched the issues, tracked as CVE-2026-35273, in its June 2026 Critical Patch Update after ZDI reported them on June 10, but the researchers say they are now working with Oracle to assign separate CVEs for each flaw. The disclosure comes roughly a month after Mandiant published a report documenting continued mass exploitation of the vulnerability by ShinyHunters, a cyberhacking group.
An SSRF that unlocks everything
The attack chain begins with a server-side request forgery in the PeopleSoft Integration Gateway (PSIGW), designated ZDI-CAN-31816. The gateway’s HttpListeningConnector is designed to translate inbound HTTP requests and route them to a specified target using a set of connector handlers. According to the ZDI writeup, the HttpTargetConnector handler performs no validation to ensure the forwarded traffic is bound for a legitimate destination. An attacker can send a POST request to the connector, specifying both a target URL and the full payload to forward — giving them the ability to make arbitrary server-side requests with attacker-controlled content.
On its own, the SSRF might seem limited. Its real power lies in what it bypasses. Oracle’s PeopleSoft Environment Management Hub (PSEMHUB) — an internal management interface served as a separate WebLogic application — uses a method called validateClient to restrict access to trusted hosts. The method checks inbound requests against an allowed-hosts list, and by default, that list includes localhost. Because the SSRF lets the attacker route requests through the server’s own loopback address, every request arrives as though it originated from a trusted internal client, satisfying the validation check entirely.
Two paths to code execution
Once past the gateway and into PSEMHUB, the researchers identified two independent routes to remote code execution.
The first, tracked as ZDI-CAN-31818, is an external-control-of-file-path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. The handler is intended to let remote clients write log entries to the PeopleSoft server’s filesystem, but according to the researchers, callers control both the file contents and the absolute file path on disk. No validation ensures the target path points to a legitimate log directory. By writing a JSP web shell to the PSEMHUB web application root, an attacker achieves immediate code execution in the context of the PeopleSoft service account.
The second route, ZDI-CAN-31817, is a deserialization-of-untrusted-data vulnerability. Using the same file-write primitive, an attacker can place a malicious XML file inside PSEMHUB’s environment metadata directory. When the HubServlet class next initializes after a service or system restart, it loads all files from that directory and deserializes them using Java’s XMLDecoder. Because XMLDecoder instantiates and configures objects during parsing, the attacker’s payload executes before a type-cast exception terminates the normal flow. The researchers note that this path avoids writing a web shell entirely, making it less likely to be detected by standard monitoring.
Active exploitation and urgent patching
Oracle’s security alert for CVE-2026-35273 describes the vulnerability as remotely exploitable without authentication and warns that successful exploitation may result in remote code execution. The company has called implementation of recommended mitigations a “high-priority risk reduction measure” and urged immediate action. The flaw carries a CVSS score of 9.8 and has been added to CISA’s Known Exploited Vulnerabilities catalog.
The real-world impact has been significant. Security researchers have reported that ShinyHunters began exploiting the flaw as early as May 2026, before the patch was available. One report indicates the group breached roughly 300 PeopleSoft instances across more than 100 organizations. The affected versions include PeopleTools 8.61 and 8.62.
The ZDI researchers framed their disclosure as a reminder that SSRFs are often underestimated. “The impact of SSRFs can sometimes be overlooked, especially if they have no standalone information disclosure impact,” the writeup notes. “Under the right circumstances, however, the humble SSRF can open the door for complete compromise.”
Leave a Reply