CVE-2026-35273
CRITICAL · 9.8 KEV EPSS 0.7%KEV-listed, confirmed in-the-wild exploitation, vendor alert, 100+ breaches, credible threat actor attribution.
What: Unauthenticated remote code execution in Oracle PeopleSoft Enterprise PeopleTools 8.61/8.62 via HTTP (CVSS 9.8 CRITICAL). Affects environment management component.
Why it matters: KEV-listed as of 2026-06-12. ShinyHunters/UNC6240 exploited as zero-day May 27–June 9, breaching 100+ organizations including universities. No patch available yet—only mitigations. 40GB data theft and extortion campaign confirmed. Oracle issued out-of-band security alert June 10.
Where it's seen: High-volume social chatter referencing Mandiant attribution, threat intel briefs, and university breach alerts. IOCs and tactical details circulating. News aggregators and security researcher posts dominant signal.
RISK: CRITICAL — Unpatched zero-day with active in-the-wild exploitation, mass organizational compromise, and extortion campaign.
Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High