Loading story…
Oracle released an emergency Security Alert for CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools that affects the Updates Environment Management component. The vulnerability carries a CVSS v3.1 score of 9.8 and can be exploited remotely over HTTP without authentication or user interaction, creating a path to arbitrary code execution and potential full system compromise.
Oracle said the issue affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62, and warned that earlier or unsupported versions may also be vulnerable even if they were not formally tested. The company published patches and mitigation guidance, while external reporting said the bug was disclosed by TrendAI Zero Day Initiative researchers Bobby Gould, Lucas Miller, and Minh Giang. Organizations were urged to apply updates immediately, limit external exposure of affected systems, monitor for suspicious activity, and keep deployments on supported versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools flaw, to its Known Exploited Vulnerabilities Catalog after obtaining evidence of active exploitation. The agency said the vulnerability poses significant risk to the federal enterprise and highlighted BOD 26-04 requirements for rapid remediation and compromise assessment on affected publicly exposed assets.
Oracle credited TrendAI Zero Day Initiative researchers Bobby Gould, Lucas Miller, and Minh Giang with reporting CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools. The references do not provide a specific date for when the report was made.
Oracle disclosed that CVE-2026-35273, a critical unauthenticated RCE in PeopleSoft PeopleTools 8.61 and 8.62, was being actively exploited and issued emergency mitigations while preparing a patch. The same reporting said ShinyHunters allegedly stole data from 300 PeopleSoft instances across more than 100 organizations.
Help Net Security reported that CVE-2026-35273 was being exploited in the wild, citing Mandiant CTO Charles Carmakal. The report also said ShinyHunters claimed breaches of Oracle PeopleSoft servers at more than 100 organizations and identified the University of Nottingham as one confirmed victim of a related cybersecurity incident.
Oracle published a Security Alert for CVE-2026-35273 and released patches and mitigation guidance for the critical unauthenticated HTTP-based RCE affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62. The alert described the flaw as impacting the Updates Environment Management component and warned that unsupported earlier versions may also be affected.
Mandiant reported that CVE-2026-35273 had been exploited as a zero-day between 2026-05-27 and 2026-06-09 and attributed the campaign to UNC6240, also known as ShinyHunters. The reporting said the campaign heavily targeted higher education organizations and that stolen data was posted to the ShinyHunters leak site on 2026-06-09.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegithub.com
Open sourcetechrepublic.com
Open sourcerunzero.com
Open sourcehelpnetsecurity.com
Open sourcedarkwebinformer.com
Open sourcebleepingcomputer.com
Open sourceoracle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle disclosed three high-severity vulnerabilities affecting core enterprise products in its Critical Patch Update advisory. **CVE-2026-34279** impacts the Event Management component of Oracle Enterprise Manager Base Platform versions `13.5` and `24.1` and is rated `CVSS 9.1`; Oracle said a high-privileged attacker with network access over HTTP could exploit the flaw to take over the platform, with potential impact extending to additional products because of a scope change. **CVE-2026-34286**, also rated `CVSS 9.1`, affects the Core component of Oracle Identity Manager Connector in Oracle Fusion Middleware version `12.2.1.4.0` and can be exploited by an unauthenticated attacker over HTTPS. Oracle also reported **CVE-2026-34309** in the Security component of PeopleSoft Enterprise PeopleTools versions `8.61` through `8.62`, assigning it a `CVSS 8.1` score. The flaw is described as easily exploitable by a low-privileged attacker with network access over HTTP and could allow unauthorized creation, deletion, or modification of critical data, along with access to sensitive or complete accessible data. Across the three disclosures, Oracle warned that successful exploitation could result in platform compromise, data tampering, and broad unauthorized access in widely deployed enterprise management and identity systems.
Jun 29, 2026
Oracle-related security advisories were issued for multiple enterprise products, including **Oracle Database Server**, **Oracle Fusion Middleware**, **Oracle REST Data Services**, **Oracle Java SE**, **Oracle Financial Services Applications**, and **Oracle E-Business Suite**. Germany's dCERT published separate advisories for each affected product line, indicating broad exposure across core Oracle infrastructure and business application environments. One of the disclosed flaws, **`CVE-2026-34275`**, affects the **Setup and Administration** component of **Oracle Advanced Inbound Telephony** in **Oracle E-Business Suite** versions **12.2.3 through 12.2.15**. Oracle rated the issue **critical** with a **CVSS v3.1 score of 9.8**, stating that an **unauthenticated attacker** with **network access over HTTP** could exploit it to achieve **full takeover** of the affected application. The vulnerability was disclosed as part of Oracle's broader Critical Patch Update, underscoring the need for organizations running Oracle platforms to prioritize patch review and remediation across exposed systems.
Jun 29, 2026
Oracle released an emergency patch on October 11, 2025, to address a high-severity information disclosure vulnerability in Oracle E-Business Suite (EBS), identified as CVE-2025-61884. The vulnerability resides in the Runtime UI component of Oracle Configurator and allows remote, unauthenticated attackers to access sensitive resources within affected EBS installations. The flaw impacts Oracle EBS versions 12.2.3 through 12.2.14, and Oracle has provided a fixed version to mitigate the risk. Security researchers have noted that, as of the time of the patch release, there is no public proof-of-concept exploit available for CVE-2025-61884, and Oracle has not reported any evidence of exploitation in the wild. Despite this, the context of recent extortion emails sent to Oracle EBS customers by the Cl0p ransomware group has heightened concern about potential targeting of this vulnerability. Arctic Wolf recommends that all organizations using affected versions of Oracle EBS apply the emergency patch as soon as possible and follow their internal patching and testing protocols to minimize operational disruption. The vulnerability’s nature as an information disclosure issue means that sensitive business data could be exposed if left unpatched, increasing the risk of data theft or further compromise. Oracle has not confirmed any direct link between CVE-2025-61884 and the Cl0p ransomware activity, but the timing of the patch and the extortion attempts has led to increased vigilance among security teams. The advisory stresses the importance of prompt remediation, given the historical interest of threat actors in Oracle EBS vulnerabilities. Organizations are urged to consult Oracle’s official advisory for detailed patching instructions and to review their exposure to the affected EBS versions. The emergency nature of the patch underscores the seriousness with which Oracle and the security community are treating this vulnerability. Security bulletins from multiple sources reiterate the need for immediate action to prevent potential exploitation. The lack of a public exploit does not preclude the possibility of targeted attacks, especially given the sophistication of groups like Cl0p. The incident highlights the ongoing risks associated with complex enterprise software suites and the need for rapid response to critical vulnerabilities. Security teams should monitor for any signs of attempted exploitation and ensure that all relevant systems are updated. The release of this patch is part of Oracle’s broader efforts to address emerging threats and protect its customers from evolving cyber risks. Organizations that delay patching may face increased scrutiny from regulators and partners, especially if a breach occurs as a result of this vulnerability. The situation remains dynamic, and further updates may be issued if exploitation is detected or additional technical details emerge.
Jun 29, 2026