Act
active
ShinyHunters Exploited Oracle PeopleSoft CVE-2026-35273 (3 Chained Flaws)
- Engineer — Act: CISA KEV listed, EPSS 0.97, public PoC, and active exploitation since May — patch PeopleSoft to the June release addressing CVE-2026-35273, then audit web and application server logs from May onward for SSRF-to-loopback traffic patterns that indicate exploitation.
- SOC/IR — Act: ShinyHunters exploitation window opens in May, meaning systems may already be compromised — hunt PeopleSoft web logs for anomalous internal management-interface requests since May and sweep for ShinyHunters-associated IOCs in your SIEM using ATT&CK Initial Access/SSRF patterns.
- Leader — Act: PeopleSoft stores HR and financial data; a months-long exploitation window by a breach-and-extortion actor creates material data-exposure risk — confirm whether your organization runs PeopleSoft, assess the May–June breach window, and brief leadership on potential notification obligations before this surfaces in the news.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.97, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.