Zero-Day Flaw in Oracle PeopleSoft Exposes 100+ Organizations Globally

A critical zero-day vulnerability in Oracle PeopleSoft has been exploited to breach over 100 organisations worldwide. The flaw, tracked as CVE-2026-35273, allowed attackers to execute code remotely without authentication or user interaction. Most of the affected institutions were universities and colleges, primarily in the US. The attacks began on 27 May 2026 and continued until 9 June, before Oracle released an advisory. The vulnerability, rated 9.8 out of 10 for severity, exists in the Environment Management component of PeopleSoft. It affects PeopleTools versions 8.61 and 8.62, with older unsupported versions likely at risk as well.

ShinyHunters, the group behind the campaign, used the flaw to gain access to breached networks. Once inside, they deployed MeshCentral for remote management and lateral movement. Among the first confirmed victims was the University of Nottingham, where approximately 455,000 unique email addresses were exposed.

Oracle has advised organisations to disable the Environment Management Hub service or block external access to sensitive endpoints. Security teams are also urged to check WebLogic access logs and monitor outbound SMB traffic for signs of compromise. The breach highlights the risks posed by unpatched vulnerabilities in widely used enterprise software. Over 100 organisations, mostly educational institutions, have been impacted. Oracle’s recommended mitigations aim to prevent further exploitation of the flaw.