Act
active
Oracle PeopleSoft CVE-2026-35273 Actively Exploited via WAF Bypass
- Engineer — Act: CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) is CISA KEV-listed with a public GitHub PoC and confirmed mass exploitation; patch Oracle PeopleSoft immediately and audit web-accessible directories for newly created web shells.
- SOC/IR — Act: ShinyHunters-linked actors are actively deploying web shells post-exploitation, indicating persistent footholds; sweep PeopleSoft-adjacent hosts for web shell artifacts and hunt for anomalous outbound connections from PeopleSoft servers since this campaign began.
- Leader — Act: A mass global campaign by a known data-exfiltration actor targeting PeopleSoft — widely used for HR and ERP — warrants same-week action; confirm whether PeopleSoft is in your environment, verify patch status with engineering, and prepare a brief for leadership given ShinyHunters’ history of large-scale data theft.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.