Oracle PeopleSoft CVE-2026-35273 Zero-Day: NC SMB ERP Defense

TL;DR: Between May 27 and June 9, 2026, the ShinyHunters extortion crew (tracked by Google's Threat Intelligence Group as UNC6240) exploited a previously unknown flaw in Oracle PeopleSoft's Environment Management component, and Mandiant notified more than 100 organizations whose IP addresses matched vulnerable endpoints; some blocked the activity and others were compromised. Oracle issued an out-of-band advisory on June 10 confirming CVE-2026-35273, a 9.8 CVSS remote code execution flaw. If you run PeopleSoft for HRMS, financials, or campus solutions, block the exposed endpoints, preserve evidence, then patch. The campaign did not stop: Google describes "earlier May and July 2026 intrusions", and a September wave got past WAF rules that matched the literal path. Google says to block on the normalized path, not a list of spellings.

Updated October 23, 2026. Oracle's October 20, 2026 Critical Patch Update does not mention CVE-2026-35273, and the June alert is still at its first revision, but that update carries 109 new PeopleSoft patches, 89 of them for PeopleTools, which it lists as "PeopleSoft Enterprise PeopleTools, versions 8.61-8.63".

Mandiant and Google Threat Intelligence reported on September 25, 2026 that UNC6240 now asks for /%50SEMHUB/ instead of /PSEMHUB/. The Hacker News explained on September 26 that many rules compare the literal path before decoding, while PeopleSoft decodes %50 back to P and serves the vulnerable servlet. Google found web shells on dozens of systems globally, in IT services, healthcare, transportation and government as well as education.

Critical takeaway: One unauthenticated HTTP request to an exposed Environment Management endpoint gives an attacker code execution on the system that holds payroll, HR and financial records. Google reports a quarter of the attacker's commands ran as root or NT Authority\SYSTEM, and the rest under PeopleSoft or WebLogic service accounts, which still expose configuration files, database connection strings and application data. Exploitation preceded the advisory and has resumed twice, so hunt as if breached.

Need an emergency PeopleSoft posture review? Contact Preferred Data Corporation at (336) 886-3282.

Do you even run PeopleSoft? Do not answer from one screen.

PeopleSoft is a back-office HR, financials and campus-administration suite, not a shop-floor system, so what you see on the terminal that schedules presses tells you nothing about what runs payroll. A portal customized years ago may never show Oracle's name either.

So get the answer from the application inventory rather than a window title. Ask your IT provider, and whoever owns the HR and finance systems, two questions: does any PeopleSoft component exist anywhere in the organization, and is any part of it reachable from the internet. Until both answers are no, treat this as unresolved.

If both come back no, the patch below is not yours, though you may still meet this through someone else holding your people's data.

What is the Oracle PeopleSoft CVE-2026-35273 zero-day?

CVE-2026-35273 is a critical unauthenticated remote code execution vulnerability in the Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, rated 9.8 on the CVSS scale, exploited from May 27 to June 9, 2026, about two weeks before Oracle's June 10 advisory. Per The Hacker News, it "needs no login and no user interaction, just network access over HTTP, to take over the server." CISA's Known Exploited Vulnerabilities catalog added it on June 12, 2026, gave federal agencies until June 15 to act, and lists its use in ransomware campaigns as known.

Education was hit hardest, but manufacturing and finance run the same software. Per Google Cloud's analysis, 68% of the 100-plus exposed organizations Mandiant alerted were academic institutions, universities and colleges. Separately, the University of Nottingham confirmed that "a well-known cybercriminal group" accessed "a significant amount of data" in its student record system. The university did not name the group or the platform; ShinyHunters claimed responsibility.

Why does CVE-2026-35273 matter so much for NC small businesses?

PeopleSoft is where the payroll file lives, and ShinyHunters' business is selling exactly that kind of file. A compromise here reaches the frameworks you report under.

• PeopleSoft holds the data regulators care about most. Payroll, benefits, financial records, student information, vendor master data, and (for federal contractors) controlled unclassified information can all sit in PeopleSoft HR and financials modules. Per G.S. 75-65, notice to affected consumers and to the Attorney General is owed "without unreasonable delay" by the business that owns or licenses the information, and it is conditional rather than automatic. The definition at G.S. 75-61(14) turns on acquisition where illegal use has occurred or is reasonably likely, or where there is a material risk of harm to a consumer, and encrypted records taken together with the key qualify on their own. That call is your counsel's. Where notice is owed, NC names no day count and allows delay only for law-enforcement needs or the work of finding contact details, determining the scope of the breach and restoring the system.
• ShinyHunters is an extortion crew, not just a thief. Per Google's September analysis, UNC6240 "has a well-established pattern of data theft extortion, that is, stealing data and threatening to release it on a data leak site unless the victim pays a ransom."

How can an NC small business respond to CVE-2026-35273 now?

Six things, in this order, which is ours: blocking changes nothing on the host, while patching, removing PSEMHUB and restarting destroy evidence.

1. Block the endpoints at the perimeter. Google's June guidance names two endpoints to block, /PSEMHUB/* and /PSIGW/HttpListeningConnector, both administrative, system-to-system components not required for ordinary user-facing sessions. Block them at a proxy or WAF whose rule matches the normalized path (UNC6240 stepped around literal /PSEMHUB/ rules with %50), or restrict them to a VPN, jump host or zero-trust gateway. A plain firewall ACL cannot filter by path; blocking the host or port with one takes the PeopleSoft web tier offline. Google says to "Monitor outbound traffic from PeopleSoft hosts to the network indicators listed"; we would also block and log all traffic, every port, to the indicators its June and September posts list, so a planted agent stops working: 5.199.162.157 (attack controller), 104.219.234.138 (exfiltration staging), 162.219.30.165 (SIDEEYE C2), 142.11.200.186 to 142.11.200.190 (staging and C2), 176.120.22.24 (leak-site mirror), the MeshAgent domains azurenetfiles.net, microsoft-entra.net and enroll.azuredevice.cloud, and winmanage-me.network (staging and MeshCentral infrastructure). Google says it has "included IOCs in a GTI collection for registered users", so treat this list as a floor. We would also block outbound TCP 445 to the internet.
2. Preserve evidence before anything restarts. Image every host whose Environment Management endpoint was reachable from the internet since May 27, 2026, on every WebLogic node, and capture memory first, because Google's September report says Ple64.exe "loads SIDEEYE in memory". Keep the WebLogic access logs, load-balancer and WAF logs, and any packet capture. Google says to "preserve evidence", and its June guidance says to check <docroot>/envmetadata/data/environment/ for recently created or modified .xml files, which attackers may use "to execute remote code via XMLDecoder upon application restart." Copy any unexplained ones into the evidence set, then remove them before step 3's patch and restart.
3. Shut the hub, then patch. Google's guidance is to "disable the EMHub service if it is not used for patching or remove the PSEMHUB application", disabling EMHub in multi-server configurations and removing PSEMHUB in single-server ones. Then apply Oracle's June 10 out-of-band Security Alert for CVE-2026-35273. Oracle lists the affected supported versions as 8.61 and 8.62, and notes earlier unsupported releases were not tested but are likely affected, so an out-of-support instance needs an upgrade path rather than a patch. The alert does not mention 8.63, which the October Critical Patch Update lists among supported PeopleTools releases; if you run 8.63, have Oracle Support confirm in writing that your build carries the fix. Then apply the October 2026 Critical Patch Update, which fixes other PeopleTools flaws.
4. Hunt on the preserved copies and the logs, on every node, and isolate any host that hits. Google says to check "all WebLogic nodes, not only the first one identified", because the attacker likely repeated its uploads so every node behind a load balancer got a shell.
   • Logs. Our method: decode the logged request paths, repeating until they stop changing so a double-encoded %2550 also resolves, then search the decoded copy case-insensitively (grep -i) for PSEMHUB. A raw grep -i PSEMHUB misses /%50SEMHUB/. Look for POST requests to /hub, any .jsp request from an outside address, and, per Google's June guidance, POST requests to /PSIGW/HttpListeningConnector from external source IPs.
   • Files. Scan PSEMHUB.war, PORTAL.war and PSEMHUB.war/envmetadata/transactions/ for files nobody on your team put there: x.jsp runs commands, u.jsp uploads files in chunks, tunnel.jsp and tunnel.jspx are Neo-reGeorg tunnels, and Ple64.exe is a trojanized Light Alloy installer carrying the SIDEEYE backdoor. Look for unexpected directories named logs, persistantstorage or scratchpad under the PSEMHUB paths.
   • MeshCentral, Windows. Google's June post names agents meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe, hardcoded to azurenetfiles.net.
   • MeshCentral and lateral movement, Linux. In the May and July intrusions, Google says the attacker dropped meshagent, meshagent.msh and meshagent.db into /tmp under the PeopleSoft service account, calling out to azurenetfiles.net, microsoft-entra.net and enroll.azuredevice.cloud. Look in /tmp for those and for a [victim]_fanout.sh script, which Google says "automates SSH credential spraying against internal hosts" listed in /etc/hosts, and search WebLogic and Process Scheduler directories for README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT. Check internal hosts for SSH logins from the PeopleSoft tier.
   • Processes. Do not rely on finding files: the attacker also ran commands with nothing written to disk, and Google warns that "Detections that rely on JSP file creation will not identify this method." Alert on shell processes (cmd.exe, /bin/sh, bash) spawned by the WebLogic Java process.
   • Network. Per Google's June write-up, watch outbound firewall and NetFlow logs for SMB traffic on TCP 445 leaving PeopleSoft hosts; Google says the exploit chain may try "to capture Windows machine-account NetNTLM hashes."
   • Ours, not Google's: triage successful responses on Environment Management endpoints from unknown sources, and audit PeopleSoft administrative accounts created or changed since May 27.
5. Rotate credentials on every exposed instance. Google's quick guide lists this among its "immediate actions", with no condition: "Rotate credentials readable by the PeopleSoft application service account, including database connection strings in psappsrv.cfg , Integration Broker credentials, and any cloud credentials reachable from the web tier." Rotate from a clean workstation. Where a host showed a web shell, fileless activity or outbound 445 traffic, isolate it first, start with hosts where WebLogic runs as root or SYSTEM, as Google advises, and (our advice) reset that host's machine account. We would also rotate PeopleSoft service accounts and any tied LDAP/AD bind accounts.
6. Look for data theft and prepare for extortion. Google says to look for large archive files (.tar, .tar.gz, .zst) on PeopleSoft and database hosts, bulk queries or exports against HR, payroll and student records tables, and large outbound transfers. It also says to "prepare for extortion communications and monitor for potential public exposure of stolen data." Decide now who takes that call, with counsel and your insurer.

What does layered PeopleSoft defense look like for an NC SMB?

Why is this an NC-specific concern?

NC healthcare, manufacturing and defense firms each face a different reporting consequence.

• Healthcare employers on PeopleSoft hold sensitive workforce data. Which obligations a breach triggers depends on what was taken: employee personal information engages North Carolina General Statute Chapter 75, while HIPAA reaches only protected health information, and its definition of that term excludes "employment records held by a covered entity in its role as employer." A group health plan record can be in scope; a personnel file or a vendor purchase order is not. That determination is counsel's, not ours.
• An NC manufacturer may meet this through somebody else. A plant running Epicor or Plex on the floor can still have its payroll, benefits and general ledger sitting on PeopleSoft at a benefits administrator, a payroll bureau or a parent company. You do not patch that instance. Under G.S. 75-65 the duty to notify affected people falls on whoever owns or licenses the records, and a bureau or administrator that only maintains them must notify that owner "immediately following discovery of the breach". Ask those providers the same two questions you ask internally, in writing.
• NC defense contractors have CMMC scope risk. The reporting clock sits in the contract clause rather than in CMMC itself, and it does not wait for a confirmed compromise. DFARS 252.204-7012 applies "When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein", defines a cyber incident to include "an actual or potentially adverse effect", and requires a report "within 72 hours of discovery". It also requires the contractor to "preserve and protect images of all known affected information systems" and "all relevant monitoring/packet capture data" "for at least 90 days" from the report, one more reason preservation (step 2) comes before patching. CMMC, codified at 32 CFR Part 170, is the program that assesses whether those safeguards are in place. Its scope covers contractor systems that "process, store, or transmit FCI or CUI; provide security protections for systems which process, store, or transmit CUI; or are not logically or physically isolated from systems which process, store, or transmit CUI." A PeopleSoft instance that touches DoD payroll, billing or workforce records needs that test applied.

Where do you stand? Take our free cybersecurity assessment or call (336) 886-3282 for a PeopleSoft posture review.

How is Preferred Data helping NC SMBs respond to CVE-2026-35273?

Preferred Data Corporation has been protecting businesses since 1987. We are headquartered in High Point, work on site within 200 miles, and deliver remotely to clients across the US and around the world. Our managed cybersecurity services include 24/7 threat detection and response (EDR and MDR), MFA and tested backups in every plan, plus patching, delivered with our managed IT services by the same team that patches your machines, for manufacturers and other growing businesses.

To hand off the two questions above, call (336) 886-3282.

Frequently Asked Questions

What exactly is CVE-2026-35273?

A 9.8-rated flaw in PeopleSoft's Environment Management component. Per Help Net Security, it affects PeopleTools 8.61 and 8.62; for 8.63, see the caveat in step 3.

Should an NC SMB assume it was breached?

If an Environment Management endpoint was reachable from the internet at any point since May 27, 2026, assume exposure for that whole period and work steps 1 to 6.

Does patching alone fix the problem?

No. Patching does nothing about access already obtained. Google's September guidance says to treat a host with a web shell as compromised: steps 1 to 6 above.

Does a WAF protect PeopleSoft from CVE-2026-35273?

Only if the rule normalizes the path before it matches; in September many did not. Google is explicit that "WAF rules and path-based blocking are not a substitute for patching." Block, preserve evidence, then apply Oracle's Security Alert, in the order of steps 1 to 3.

How fast can Preferred Data deploy a posture review?

Call (336) 886-3282 and we will scope it on the first call.

Related Resources

• Managed Cybersecurity Services
• Managed IT Services
• Manufacturing Industry Solutions
• Group-IB 2026: Supply Chain #1 Cyber Threat
• ShinyHunters FBI Hiring-Portal Claim - Same crew, claiming a PeopleSoft entry point the FBI has not confirmed
• Free Cybersecurity Assessment
• Contact Preferred Data Corporation