ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

T2Critical 100Covered by 1 source · first reported by The Hacker News at 28 Oct, 06:04 UTC

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that…

science security

Sources

T2ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained FlawsThe Hacker News28 Oct, 06:04

Vulnerabilities

CVE-2026-35273

Why this score

Signals contributing to the severity score
Signal	Points
kev added	50
kev short fuse — 3 days to remediate	15
kev ransomware	10
epss high	20
public poc — 3 repositories	20