Oracle released a Security Alert for CVE-2026-35273 on 10 June 2026, according to Google. Oracle's CVE record describes an easily exploitable flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools that lets an unauthenticated attacker with network access via HTTP take over PeopleTools, on supported versions 8.61 and 8.62, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CISA's enrichment of the record shows it was added to the KEV catalog on 12 June 2026.

UPDATE 25–26 Sep 2026: Mandiant / Google Threat Intelligence Group report renewed UNC6240 (ShinyHunters) mass exploitation: actors bypass literal WAF path blocks by requesting /%50SEMHUB/ (percent-encoded P) so proxies miss /PSEMHUB/ while WebLogic still routes to the vulnerable servlet; web shells (x.jsp / u.jsp and variants) and fileless command execution observed on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation, and government. On Windows hosts, trojanized Ple64.exe (masquerading as signed Light Alloy media-player installer; EV cert later revoked) loads in-memory SIDEEYE C++ backdoor (C2 162.219.30.165 TCP/3333–3334); MeshCentral agents also used for persistence.

June campaign hit education as a zero-day (27 May–9 June); this wave targets orgs that WAF-mitigated but did not patch or disable EMHub. Cybernews (26 Sep) cites Google notifying 100+ organisations. (sources: Google Cloud; Google Cloud / Mandiant GTIG; Oracle CVE record; Cybernews)

Correction (27 Oct 2026): Oracle's Security Alert returns 403 to Cyberstack, so the affected versions, score and description are now credited to Oracle's CVE record and the alert date to Google; a label that no readable source gives was removed. (source: CVE.org; Google Cloud)

UPDATE (28 Oct 2026, Perth; Zero Day Initiative): In a write-up dated 27 October, Bobby Gould of TrendAI's Zero Day Initiative says ZDI first reported this CVE to Oracle on 10 June 2026 and that, although Oracle issued a patch under a single CVE, ZDI reported three distinct vulnerabilities across multiple PeopleSoft components; ZDI says it is coordinating with Oracle to assign separate CVEs for each issue.

According to the write-up, the chain starts with a server-side request forgery in the PeopleSoft Integration Gateway (PSIGW) that lets attackers make requests satisfying the validateClient check of the PeopleSoft Environment Management Hub (PSEMHUB) and reach endpoints vulnerable to remote code execution. (source: Zero Day Initiative)