CVE-2026-35273: Oracle PeopleSoft RCE Exploited as Zero-Day by ShinyHunters

Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign orchestrated by UNC6240, known publicly as ShinyHunters. This campaign, observed between May 27 and June 9, 2026, targeted Oracle PeopleSoft application infrastructure through the exploitation of a Zero-Day vulnerability, CVE-2026-35273, a critical RCE flaw with a CVSS score of 9.8. This vulnerability resides in the Environment Management component, specifically targeting Environment Management Hub (PSEMHUB) endpoints, as detailed by Mandiant and Google Threat Intelligence Group.

The exploitation of this CVE was active prior to Oracle’s advisory on June 10, 2026, confirming its use as a zero-day. Google initiated notifications to over 100 global organizations with potentially vulnerable IP addresses, with 68 percent of these entities operating within the higher education sector, primarily in the United States. This highlights a significant and concentrated threat to academic institutions, underscoring the urgency for robust defense against such targeted campaigns.

Threat Detail & Campaign Overview

The ShinyHunters campaign leveraged a sophisticated staging infrastructure. Public threat reports on June 9, 2026, by @nahamike01 on X, revealed open attacker directories across five sequential IP addresses (142.11.200.186-.190). These servers hosted Python SimpleHTTP servers on port 8888, exposing attacker materials, custom agents, and command histories that provided critical insights into their TTPs.

The staging environments featured pre-configured Windows MeshCentral agent binaries disguised as legitimate Microsoft Azure services (e.g., meshagent32-azure-ops.exe). MeshCentral, an open-source remote management server, was used to establish a C2 channel via wss://azurenetfiles.net:443/agent.ashx. The domain azurenetfiles.net was deliberately chosen for masquerading, mimicking Microsoft Azure NetApp Files endpoints to evade detection. An unconfigured Linux meshagent binary was also present, suggesting dynamic parameter passing during deployment.

While Google’s rapid notification campaign enabled some organizations to block activity or remediate vulnerabilities, others experienced compromise, leading to data exfiltration and subsequent publication on the ShinyHunters Data Leak Site (DLS).

Technical Analysis of CVE-2026-35273 Zero-Day Exploit

Analysis of the exposed .bash_history file, identical across all staging hosts, provided a chronological account of the attackers’ operations. On May 27, 2026, the attackers set up their C2 staging environment by installing MeshCentral (v1.1.59) and acme-client for SSL certificate provisioning for azurenetfiles.net.

Key administrative and malicious operations observed in the command history include:

• Staging Infrastructure Setup: Deployment of MeshCentral and acme-client, compilation of custom Windows MeshCentral agents communicating with azurenetfiles.net.
• Targeted Internal Reconnaissance: Using the meshctrl.js utility, attackers performed reconnaissance to understand Oracle PeopleSoft configurations. This involved inspecting psappsrv.cfg for machine names and IP addresses, auditing network configurations and active mounts (mount | grep -E "psoft|ps_config|nfs"), querying local host tables (cat /etc/hosts), and inspecting WebLogic XML configurations (config.xml) to map internal application servers. This level of detail is crucial for security professionals wondering how to detect Oracle PeopleSoft compromise in their environment.
• Lateral Movement & Script Propagation: Attackers deployed a custom propagation script, [victim_abbreviation]_fanout.sh, to /tmp on compromised systems. This script automated SSH credential spraying against internal hosts by parsing /etc/hosts and using hardcoded administrative usernames and passwords. Successful SSH sessions led to the deployment of a defacement and extortion marker file, README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, into WebLogic and Process Scheduler directories.
• Exfiltration & DLS Connection: Compromised directories containing stolen data were compressed using zstd. Operations concluded with an outbound SSH connection from the staging host to 176.120.22.24, the IP address hosting the public mirror of the ShinyHunters DLS. This directly correlates with the data leaks observed on June 9, 2026.

Remediation and Hardening Guidance

To effectively defend against this campaign, organizations running Oracle PeopleSoft must implement immediate security measures, especially concerning mitigating ShinyHunters Oracle PeopleSoft attacks.

Network Isolation & WAF Rules

• Endpoint Access Restrictions: Immediately block external network access to /PSEMHUB/* (specifically /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the network perimeter or firewall. Relying solely on Web Application Firewall (WAF) body-inspection rules is insufficient.
• Non-Breaking Action: Restricting these endpoints is non-breaking for standard end-user operations as they are administrative or system-to-system components.

Log & Endpoint Monitoring

• Access Log Analysis: Audit PIA WebLogic access logs for HTTP POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector from external or untrusted IPs.
• SSRF Detection: Analyze requests to /PSIGW/HttpListeningConnector for loopback IP addresses (e.g., 127.0.0.1, localhost) or internal IP ranges within request headers or parameters, indicating Server-Side Request Forgery (SSRF) attempts.

Network Telemetry

• Outbound Port 445 Monitoring: Monitor outbound firewall logs and NetFlow data for outbound SMB traffic (TCP port 445) from PeopleSoft hosts to untrusted external destinations, as the exploit chain may attempt to capture NetNTLM hashes.

Host-Level Auditing & Filesystem Checks

Conduct a forensic audit of the web-tier filesystem on PeopleSoft hosts for IoCs:

• Webshell Detection: Scan the WebLogic web application directory <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/ for unexpected *.jsp files.
• Unauthorized Staging: Inspect .../PSEMHUB.war/envmetadata/transactions/ for unauthorized folders, files, or binary drops.
• Unexpected Directories: Look for directories named logs, persistantstorage, or scratchpad under PSEMHUB directories.
• XMLDecoder Persistence: Check <docroot>/envmetadata/data/environment/ for recently created or modified .xml files, which could indicate remote code execution via XMLDecoder upon application restart.

Organizations must apply all Critical Patch Updates, Critical Security Patch Updates, and Security Alerts without delay. Review the full Oracle Security Alert Advisory - CVE-2026-35273 for comprehensive details.

Indicators of Compromise (IOCs)

To aid in hunting and identifying related activity, the following IoCs have been provided.

Staging & C2 Network Indicators

• 142.11.200.186
• 142.11.200.187
• 142.11.200.188
• 142.11.200.189
• 142.11.200.190
• azurenetfiles.net

Staging Payloads & Attacker Files

File Path / Name	Indicator Type	Description	Value / Hash (SHA-256)
.bash_history	File Hash	Attacker command history	2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35
meshagent64-azure-ops.exe	File Hash	Pre-configured Windows agent	f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc
meshagent64-v2.exe	File Hash	Pre-configured Windows agent	d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f
meshagent32-azure-ops.exe	File Hash	Pre-configured Windows agent	c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f
meshagent	File Hash	Unconfigured Linux agent	68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309
README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	Filename	Defacement / extortion marker	N/A
[victim_abbreviation]_fanout.sh	Filename	Propagation script	N/A

Related: Oracle PeopleSoft RCE via CVE-2026-35273 — Mitigation Guide, April 2026 Patch Tuesday: SharePoint Zero-Day, BlueHammer, & Adobe RCE