CVE-2026-35273: Oracle PeopleSoft Zero-Day Chained Flaws Exploited

# CVE-2026-35273: Oracle PeopleSoft Zero-Day Chained Flaws Exploited

https://gcdradar.vercel.app/incidents/cve-2026-35273-oracle-peoplesoft-zero-day-chained-flaws-expl · AIR-2026-1615 · closed 2026-11-11

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild by threat actors.
- Fix status: Patched
- First reported: 2026-10-28 (happened 2026-06)
- AI role: No AI role
- Products: PeopleSoft
- CVE ids: CVE-2026-35273

## Summary

Researchers revealed that a critical Oracle PeopleSoft zero-day exploited by ShinyHunters actually consists of three chained flaws patched under CVE-2026-35273. The vulnerability stems from an SSRF issue allowing unauthorized access to internal management interfaces.

## What to do

Update Oracle PeopleSoft to the latest patched version addressing CVE-2026-35273.

## Affected and fixed versions

- Affected: Oracle PeopleSoft
- Fixed in: Oracle PeopleSoft patch update

## Latest updates

- 2026-10-28: ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html)

## Sources

- 2026-10-28 The Hacker News: ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.