# CVE-2026-35273: Oracle PeopleSoft RCE Exploited as Zero-Day by ShinyHunters > Mandiant and GTIG identified ShinyHunters (UNC6240) exploiting CVE-2026-35273, a critical RCE in Oracle PeopleSoft, targeting higher education. - Published: 2026-06-12T09:42:34.000Z - Severity: high - Category: Threat Intel - Tags: ShinyHunters, UNC6240, Oracle PeopleSoft, CVE-2026-35273, Zero-Day, RCE, Higher Education - Author: Runtime Rebel Intel - Primary source: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/ - Canonical: https://runtimerebel.com/blog/cve-2026-35273-oracle-peoplesoft-rce-exploited-as-zero-day-by-shinyhunters ## Key points - Immediate impact: ShinyHunters exploited a zero-day RCE in Oracle PeopleSoft, leading to data theft and extortion, primarily affecting the higher education sector. - Affected systems: Oracle PeopleSoft application infrastructure, specifically the Environment Management Hub (PSEMHUB) endpoints vulnerable to CVE-2026-35273. - Remediation: Immediately block external network access to /PSEMHUB/* and /PSIGW/HttpListeningConnector endpoints and apply Oracle's patch. Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign orchestrated by UNC6240, known publicly as ShinyHunters. This campaign, observed between May 27 and June 9, 2026, targeted Oracle PeopleSoft application infrastructure through the exploitation of a [Zero-Day](/glossary#zero-day) vulnerability, [CVE-2026-35273](/cve/cve-2026-35273), a critical [RCE](/glossary#rce) flaw with a [CVSS](/glossary#cvss) score of 9.8. This vulnerability resides in the Environment Management component, specifically targeting Environment Management Hub (PSEMHUB) endpoints, as detailed by [Mandiant and Google Threat Intelligence Group](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/). The exploitation of this [CVE](/glossary#cve) was active prior to Oracle's advisory on June 10, 2026, confirming its use as a zero-day. Google initiated notifications to over 100 global organizations with potentially vulnerable IP addresses, with 68 percent of these entities operating within the higher education sector, primarily in the United States. This highlights a significant and concentrated threat to academic institutions, underscoring the urgency for robust defense against such targeted campaigns. ## Threat Detail & Campaign Overview The ShinyHunters campaign leveraged a sophisticated staging infrastructure. Public threat reports on June 9, 2026, by @nahamike01 on X, revealed open attacker directories across five sequential IP addresses (`142.11.200.186-.190`). These servers hosted Python SimpleHTTP servers on port 8888, exposing attacker materials, custom agents, and command histories that provided critical insights into their [TTP](/glossary#ttp)s. The staging environments featured pre-configured Windows MeshCentral agent binaries disguised as legitimate Microsoft Azure services (e.g., `meshagent32-azure-ops.exe`). MeshCentral, an open-source remote management server, was used to establish a [C2](/glossary#c2) channel via `wss://azurenetfiles.net:443/agent.ashx`. The domain `azurenetfiles.net` was deliberately chosen for masquerading, mimicking Microsoft Azure NetApp Files endpoints to evade detection. An unconfigured Linux `meshagent` binary was also present, suggesting dynamic parameter passing during deployment. While Google's rapid notification campaign enabled some organizations to block activity or remediate vulnerabilities, others experienced compromise, leading to data exfiltration and subsequent publication on the ShinyHunters Data Leak Site (DLS). ### Technical Analysis of CVE-2026-35273 Zero-Day Exploit Analysis of the exposed `.bash_history` file, identical across all staging hosts, provided a chronological account of the attackers' operations. On May 27, 2026, the attackers set up their [C2](/glossary#c2) staging environment by installing MeshCentral (v1.1.59) and `acme-client` for SSL certificate provisioning for `azurenetfiles.net`. Key administrative and malicious operations observed in the command history include: * **Staging Infrastructure Setup:** Deployment of MeshCentral and `acme-client`, compilation of custom Windows MeshCentral agents communicating with `azurenetfiles.net`. * **Targeted Internal Reconnaissance:** Using the `meshctrl.js` utility, attackers performed reconnaissance to understand Oracle PeopleSoft configurations. This involved inspecting `psappsrv.cfg` for machine names and IP addresses, auditing network configurations and active mounts (`mount | grep -E "psoft|ps_config|nfs"`), querying local host tables (`cat /etc/hosts`), and inspecting WebLogic XML configurations (`config.xml`) to map internal application servers. This level of detail is crucial for security professionals wondering **how to detect Oracle PeopleSoft compromise** in their environment. * **[Lateral Movement](/glossary#lateral-movement) & Script Propagation:** Attackers deployed a custom propagation script, `[victim_abbreviation]_fanout.sh`, to `/tmp` on compromised systems. This script automated SSH credential spraying against internal hosts by parsing ` /etc/hosts` and using hardcoded administrative usernames and passwords. Successful SSH sessions led to the deployment of a defacement and extortion marker file, `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT`, into WebLogic and Process Scheduler directories. * **Exfiltration & DLS Connection:** Compromised directories containing stolen data were compressed using `zstd`. Operations concluded with an outbound SSH connection from the staging host to `176.120.22.24`, the IP address hosting the public mirror of the ShinyHunters DLS. This directly correlates with the data leaks observed on June 9, 2026. ## Remediation and Hardening Guidance To effectively defend against this campaign, organizations running Oracle PeopleSoft must implement immediate security measures, especially concerning **mitigating ShinyHunters Oracle PeopleSoft attacks**. ### Network Isolation & WAF Rules * **Endpoint Access Restrictions:** Immediately block external network access to `/PSEMHUB/*` (specifically `/PSEMHUB/hub`) and `/PSIGW/HttpListeningConnector` at the network perimeter or firewall. Relying solely on Web Application Firewall (WAF) body-inspection rules is insufficient. * **Non-Breaking Action:** Restricting these endpoints is non-breaking for standard end-user operations as they are administrative or system-to-system components. ### Log & Endpoint Monitoring * **Access Log Analysis:** Audit PIA WebLogic access logs for HTTP `POST` requests to `/PSEMHUB/hub` and `/PSIGW/HttpListeningConnector` from external or untrusted IPs. * **SSRF Detection:** Analyze requests to `/PSIGW/HttpListeningConnector` for loopback IP addresses (e.g., `127.0.0.1`, `localhost`) or internal IP ranges within request headers or parameters, indicating Server-Side Request Forgery (SSRF) attempts. ### Network Telemetry * **Outbound Port 445 Monitoring:** Monitor outbound firewall logs and NetFlow data for outbound SMB traffic (TCP port 445) from PeopleSoft hosts to untrusted external destinations, as the exploit chain may attempt to capture NetNTLM hashes. ### Host-Level Auditing & Filesystem Checks Conduct a forensic audit of the web-tier filesystem on PeopleSoft hosts for [IoC](/glossary#ioc)s: * **Webshell Detection:** Scan the WebLogic web application directory `/webserv//applications/peoplesoft/PSEMHUB.war/` for unexpected `*.jsp` files. * **Unauthorized Staging:** Inspect `.../PSEMHUB.war/envmetadata/transactions/` for unauthorized folders, files, or binary drops. * **Unexpected Directories:** Look for directories named `logs`, `persistantstorage`, or `scratchpad` under PSEMHUB directories. * **XMLDecoder Persistence:** Check `/envmetadata/data/environment/` for recently created or modified `.xml` files, which could indicate remote code execution via XMLDecoder upon application restart. Organizations must apply all Critical Patch Updates, Critical Security Patch Updates, and Security Alerts without delay. Review the full [Oracle Security Alert Advisory - CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html) for comprehensive details. ## Indicators of Compromise (IOCs) To aid in hunting and identifying related activity, the following [IoC](/glossary#ioc)s have been provided. ### Staging & C2 Network Indicators * `142.11.200.186` * `142.11.200.187` * `142.11.200.188` * `142.11.200.189` * `142.11.200.190` * `azurenetfiles.net` ### Staging Payloads & Attacker Files | File Path / Name | Indicator Type | Description | Value / Hash (SHA-256) | | :---------------------------------------- | :------------- | :--------------------------------- | :------------------------------------------------- | | `.bash_history` | File Hash | Attacker command history | `2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35` | | `meshagent64-azure-ops.exe` | File Hash | Pre-configured Windows agent | `f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc` | | `meshagent64-v2.exe` | File Hash | Pre-configured Windows agent | `d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f` | | `meshagent32-azure-ops.exe` | File Hash | Pre-configured Windows agent | `c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f` | | `meshagent` | File Hash | Unconfigured Linux agent | `68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309` | | `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` | Filename | Defacement / extortion marker | N/A | | `[victim_abbreviation]_fanout.sh` | Filename | Propagation script | N/A | **Related:** [Oracle PeopleSoft RCE via CVE-2026-35273 — Mitigation Guide](/blog/oracle-peoplesoft-rce-via-cve-2026-35273-mitigation-guide), [April 2026 Patch Tuesday: SharePoint Zero-Day, BlueHammer, & Adobe RCE](/blog/april-2026-patch-tuesday-sharepoint-zero-day-bluehammer-adobe-rce) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-35273-oracle-peoplesoft-rce-exploited-as-zero-day-by-shinyhunters