CVE-2026-35273: Oracle PeopleSoft Three-Flaw SSRF Chain Exploited by ShinyHunters — Detection and Remediation Guide

The critical Oracle PeopleSoft vulnerability that the ShinyHunters extortion group has been exploiting since May 2026 is not a single bug — it is three distinct flaws chained together, according to the researchers who originally reported the issue. Oracle patched all three under a single identifier, CVE-2026-35273, in its June 2026 Critical Patch Update (CPU). The root of the chain is a server-side request forgery (SSRF) that lets an unauthenticated attacker reach an internal PeopleSoft management interface — because the application implicitly trusts requests originating from its own loopback address.

This is a worst-case architectural failure pattern: a perimeter-reachable component that can be coerced into making requests on the attacker's behalf, combined with a trust model that treats 127.0.0.1 as inherently benign. ShinyHunters — a group with a long track record of mass data theft and extortion against enterprise platforms — recognized the value of this chain quickly and has been actively exploiting unpatched PeopleSoft internet-facing deployments for months before the full technical picture became public this week.

If you run PeopleSoft — particularly internet-facing or partner-portal-exposed PIA (PeopleSoft Internet Architecture) instances — and you did not apply the June 2026 CPU, assume you are exposed. This post breaks down the chain, gives you concrete detection content for your SOC, and walks through remediation and verification.

Technical Analysis

Affected Products

• Oracle PeopleSoft Enterprise (PeopleTools / PIA deployments) — the vulnerability resides in the PeopleSoft web tier, which typically runs on Oracle WebLogic Server behind a load balancer or reverse proxy.
• The issue affects PeopleSoft instances where the PIA web tier is reachable by untrusted users. Both internet-facing portals and large internal deployments (HR self-service, campus portals, supplier portals) are in scope.
• Patched in the Oracle Critical Patch Update — June 2026, under CVE-2026-35273 (all three chained flaws fixed under this single CVE identifier).

Because Oracle shipped three fixes under one CVE, vulnerability scanners and patch-management tooling that simply check for the presence of "the CVE-2026-35273 patch" may not validate that all three underlying flaws are actually closed. Verify remediation at the component level, not just the CPU level — more on that below.

How the Attack Chain Works (Defender's View)

Based on the researchers' disclosure, the chain operates as follows:

1. Flaw 1 — Unauthenticated SSRF in the PIA web tier. A remotely reachable PeopleSoft component accepts attacker-controlled input that causes the server to issue an HTTP request to an arbitrary destination. No credentials are required. This is the entry point: the attacker never touches the internal interface directly — the PeopleSoft server does it for them.
2. Flaw 2 — Loopback trust on the internal management interface. PeopleSoft's internal management interface (bound to or restricted toward localhost) treats connections sourced from the server's own loopback address as trusted/administrative. Because the SSRF forces the server to originate the request itself, the forged request arrives at the management interface appearing to come from 127.0.0.1 — and is trusted. This is the pivot that converts a "limited" SSRF into full administrative reach.
3. Flaw 3 — A privileged operation exposed on that management interface. Once the attacker can interact with the management interface as a trusted local client, they can invoke functionality that yields high-impact outcomes — consistent with ShinyHunters' observed behavior of data theft and extortion against PeopleSoft customers.

Individually, each flaw might have been rated moderate. Chained, they produce unauthenticated remote compromise of the application tier. This is why Oracle's single-CVE bundling is operationally dangerous for defenders: it obscures the fact that the exploit requires all three fixes, and partial remediation leaves the chain intact.

Exploitation Status

• Confirmed active exploitation in the wild. ShinyHunters has been exploiting this chain since May 2026 — roughly a month before the June CPU shipped, meaning there was a window of zero-day exploitation.
• The researchers who reported the flaws disclosed the three-bug chained structure publicly this week (October 2026), which historically triggers a second wave of exploitation as lower-sophistication actors weaponize the now-public details.
• At the time of writing, defenders should check CISA's Known Exploited Vulnerabilities (KEV) catalog for CVE-2026-35273 status and treat the bug as KEV-equivalent priority regardless, given confirmed criminal exploitation.

Detection & Response

The detections below are built around the observable mechanics of the chain: SSRF-generated requests hitting loopback-bound management endpoints, anomalous request patterns in PIA/WebLogic access logs, and post-exploitation behavior on the web tier (the Java/WebLogic process spawning command interpreters or making unexpected egress connections).

Sigma Rules

---
title: PeopleSoft PIA Access to Internal Management Interface from Loopback
id: 3f9c1a74-2b6e-4d58-9a21-cve20263527301
status: experimental
description: Detects HTTP requests in PeopleSoft/WebLogic access logs targeting internal management or administrative endpoints sourced from loopback, consistent with the CVE-2026-35273 SSRF chain where forged requests appear to originate from 127.0.0.1.
references:
  - https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection_src:
    c-ip:
      - '127.0.0.1'
      - '::1'
  selection_uri:
    cs-uri|contains:
      - '/PSIGW/'
      - '/psp/'
      - '/psc/'
      - 'admin'
      - 'console'
      - 'management'
  condition: all of selection_*
falsepositives:
  - Legitimate local health checks and monitoring agents polling PIA endpoints
  - Integration Broker gateway self-checks
level: high
---
title: WebLogic or PeopleSoft Java Process Spawning Command Shell
id: 8d2e5b91-4c7a-4f63-b8d2-cve20263527302
status: experimental
description: Detects the WebLogic/PeopleSoft Java runtime spawning command interpreters or download utilities, a common post-exploitation behavior after SSRF-driven compromise of the application tier.
references:
  - https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'weblogic'
      - 'peoplesoft'
      - 'piapss'
      - 'psappsrv'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: all of selection_*
falsepositives:
  - Rare PeopleSoft Process Scheduler jobs invoking scripts — baseline and exclude known scheduled task command lines
level: critical
---
title: Linux PeopleSoft Web Tier Spawning Shell or Network Utility
id: 5a1f7c03-6d9b-4e28-a7f4-cve20263527303
status: experimental
description: Detects the PeopleSoft/WebLogic Java process on Linux spawning shells or network utilities, consistent with post-exploitation following CVE-2026-35273 SSRF chain compromise.
references:
  - https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains:
      - 'weblogic'
      - 'peoplesoft'
      - 'piapss'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: all of selection_*
falsepositives:
  - Administrative scripts invoked by Process Scheduler — baseline expected jobs before enabling at high severity
level: critical

KQL — Microsoft Sentinel / Defender

This query hunts web-tier logs (ingested via CEF/Syslog from your load balancer, reverse proxy, or WebLogic access logs) for the SSRF fingerprint: externally initiated requests whose logged source or forwarded chain indicates the request terminated against a loopback-bound administrative endpoint, plus spikes in requests to PeopleSoft gateway paths. It also correlates with Defender process telemetry for post-exploitation on the web tier.

// Hunt 1: SSRF fingerprint - requests to PeopleSoft gateway/admin paths where
// the effective source appears to be loopback (forged via the SSRF)
let PeopleSoftPaths = dynamic(["/PSIGW/", "/psp/", "/psc/", "admin", "console", "management"]);
union isfuzzy=true (CommonSecurityLog | project TimeGenerated, SourceIP, DestinationIP, RequestURL=coalesce(RequestURL, AdditionalExtensions), DeviceProduct),
(Syslog | project TimeGenerated, SourceIP=HostIP, DestinationIP=Computer, RequestURL=SyslogMessage, DeviceProduct=ProcessName)
| where TimeGenerated > ago(14d)
| where RequestURL has_any (PeopleSoftPaths)
| where SourceIP in ("127.0.0.1", "::1", "0:0:0:0:0:0:0:1")
    or RequestURL has_any ("127.0.0.1", "localhost", "[::1]")  // SSRF target embedded in request
| summarize RequestCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by SourceIP, DestinationIP, RequestURL
| order by RequestCount desc;

// Hunt 2: Post-exploitation - WebLogic/PeopleSoft Java spawning shells or tools
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessFileName =~ "java"
| where InitiatingProcessCommandLine has_any ("weblogic", "peoplesoft", "piapss", "psappsrv")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","sh","bash","nc","ncat","python","python3","perl")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

Velociraptor VQL

This artifact hunts PeopleSoft/WebLogic hosts for the two highest-signal artifacts: suspicious child processes of the Java web tier, and established loopback connections involving the web server process that indicate SSRF-forged requests hitting the management interface.

-- CVE-2026-35273 hunt: PeopleSoft web-tier post-exploitation artifacts
-- 1) Suspicious child processes spawned by the Java/WebLogic runtime
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
   SELECT Pid FROM pslist()
   WHERE CommandLine =~ '(?i)(weblogic|peoplesoft|piapss|psappsrv)'
     AND Name =~ '(?i)java'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|sh$|bash|curl|wget|nc|ncat|python|perl|certutil|bitsadmin)'

-- 2) Loopback connections held by the web-tier process (SSRF to local mgmt interface)
SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)java'
  AND (RemoteIP =~ '^(127\.|::1$)' OR Laddr.IP =~ '^(127\.|::1$)')
  AND Status =~ 'ESTAB'

Log Review / Verification Script

Run this on your PeopleSoft web tier (Linux example; adapt paths for your PIA/WebLogic install) to sweep access logs for exploitation indicators — requests embedding loopback targets and bursts hitting gateway/admin paths.

#!/bin/bash
# CVE-2026-35273 indicator sweep for PeopleSoft PIA / WebLogic access logs
LOG_DIRS="/u01/app/oracle /opt/oracle /psoft"
DAYS=90

echo "=== [1] Requests with embedded loopback/localhost targets (SSRF indicator) ==="
find $LOG_DIRS -name "access*.log*" -mtime -$DAYS 2>/dev/null | while read f; do
  zgrep -aE "(127\.0\.0\.1|localhost|\[::1\]).*(PSIGW|/psp/|/psc/|admin|console)" "$f" 2>/dev/null && echo "  ^^ in $f"
done

echo "=== [2] Externally sourced requests hitting gateway/admin paths, top talkers ==="
find $LOG_DIRS -name "access*.log*" -mtime -$DAYS 2>/dev/null -exec zgrep -ahE "(PSIGW|/psp/|/psc/)" {} \; 2>/dev/null \
  | grep -vE "^(127\.0\.0\.1|::1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

echo "=== [3] Confirm June 2026 CPU / PeopleTools patch level ==="
# PeopleTools patch level is recorded in the PIA and in PSSTATUS / version files
grep -r "ToolsRel" $LOG_DIRS/*/webserv/*/piaconfig/properties/ 2>/dev/null | head -5
find $LOG_DIRS -name "version.txt" -path "*peoplesoft*" -exec cat {} \; 2>/dev/null | head -5

echo "=== [4] WebLogic patch inventory (June 2026 CPU should be present) ==="
find $LOG_DIRS -name "registry.xml" -path "*oracle_common*" 2>/dev/null | head -3
ls -la $LOG_DIRS/*/oracle_common/inventory/ 2>/dev/null

echo "Done. Any hits in [1] or unexpected IPs in [2] warrant immediate IR escalation."

Remediation

1. Apply the Oracle June 2026 Critical Patch Update immediately. All three chained flaws are fixed under CVE-2026-35273 in the June 2026 CPU. Because three fixes ship under one CVE, verify at the component level: confirm with Oracle Support (or via the CPU documentation for your PeopleTools release) that the SSRF fix, the loopback trust fix, and the management-interface hardening are all present in your applied patch set. Official reference: Oracle Critical Patch Update Advisory — June 2026 (https://www.oracle.com/security-alerts/).
2. Treat this as emergency change, not routine patching. Confirmed in-the-wild exploitation by ShinyHunters since May 2026, plus public disclosure of the chain mechanics this week, means exploitation will accelerate. If you are subject to CISA KEV deadlines (check the KEV catalog for CVE-2026-35273), those dates are a floor, not a target.
3. Restrict management-interface exposure at the network layer. The internal management interface should be bound to localhost only and unreachable from the web tier's service network path except where explicitly required. Where the architecture allows, add explicit deny rules so that even loopback-sourced requests from the web-tier process context to management ports are impossible without a dedicated local service account path.
4. Kill the loopback trust assumption. If your PeopleSoft/WebLogic configuration or any custom filters treat 127.0.0.1 as implicitly trusted for administrative functions, that design decision is the load-bearing flaw in this chain. Require authentication on the management interface regardless of source address — this is defense-in-depth that survives the next SSRF.
5. Egress-filter the web tier. A PeopleSoft PIA server has no legitimate reason to initiate arbitrary HTTP requests to loopback administrative endpoints or to the broader internet on attacker-controlled URLs. Enforce a strict egress allowlist from the web tier; this breaks the SSRF leg of the chain even before patching.
6. Hunt before you patch. Given exploitation since May 2026, patching alone is insufficient — run the detections above across at least 90 days of retained web-tier logs. Evidence of forged loopback requests or Java-spawned shells means you are in incident-response mode, not patch mode: preserve disk images and memory of the web tier, rotate all credentials stored in or reachable from PeopleSoft (database service accounts, integration broker credentials, directory bind accounts), and scope downstream data access before announcing remediation complete.
7. Audit your external attack surface. Enumerate every internet-reachable PeopleSoft PIA instance — including forgotten test, development, and partner-portal instances, which are disproportionately represented in ShinyHunters victim lists. Take non-essential instances off the public internet or place them behind authenticated gateways (VPN/ZTNA) until patched.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub