Oracle has recently issued a pressing security alert to its customers regarding a critical vulnerability in its PeopleSoft environments. This response follows claims made by the infamous threat actor group ShinyHunters, which stated that they exploited a previously unknown flaw to compromise more than 100 organizations.

The vulnerability, identified as CVE-2026-35273, resides within Oracle PeopleSoft PeopleTools and is classified with a CVSS score of 9.8 out of 10, marking it as exceptionally severe. The alert specifies that various Oracle PeopleSoft Enterprise Applications users may also experience impacts due to this vulnerability. It poses a significant risk, as it can be remotely exploited without any required authentication. If successfully leveraged, it may lead to remote code execution, potentially exposing sensitive organizational data.

ShinyHunters claimed that they had taken advantage of a zero-day vulnerability related to Oracle PeopleSoft systems to infiltrate customer environments and extract sensitive information. In light of these unsettling revelations, Oracle has provided guidance for its customer base, adding that there is currently no evidence suggesting any breach of its Cloud infrastructure.

Researchers and security response teams have indicated that the attacks appear to have targeted installations of PeopleSoft that are managed by customers instead of Oracle’s Cloud services. As a precaution, they have urged organizations using affected applications to conduct thorough reviews of their configurations, implement necessary security updates, and monitor for any signs of potential intrusions.

In its alert, Oracle emphasized the urgency of addressing the identified vulnerability by recommending immediate action from its customers. It advised that organizations treat this situation as a high-priority risk reduction measure. Furthermore, it urged users to deploy recommended perimeter network mitigations and rigorously audit outbound server traffic for both rogue command-and-control protocols, such as MeshCentral, and unauthorized activities. Additionally, a rotation of core application service credentials stored within local server configuration files was strongly advised.

John Carberry, a security expert from Xcape Inc, remarked on the significance of this situation, stating that it marks a pivotal change in the threat landscape. Complex Enterprise Resource Planning (ERP) applications, which have long enjoyed a level of operational obscurity, are now increasingly targeted by automated large-scale zero-day exploitation efforts. The active weaponization of CVE-2026-35273 underscores the fact that attackers can easily bypass perimeter defenses, thereby achieving unauthenticated remote code execution. This exposure could potentially compromise critical repositories of institutional, financial, and payroll data that many organizations rely on.

Carberry emphasized that security leaders must critically evaluate Oracle’s reassurances concerning the cloud infrastructure, understanding that customer-managed environments utilizing PeopleTools versions 8.61 or 8.62 are currently at risk. He emphasized that organizations must prioritize addressing this vulnerability. Immediate actions should include the deployment of the prescribed perimeter network mitigations, a strict audit of outbound server traffic for rogue activities, and the rotation of service credentials stored in local configurations.

To summarize Carberry’s insights, he offered several vital takeaways for organizations striving to protect themselves in light of the ongoing threat:

1. Bypassing Perimeters: The vulnerability permits unauthenticated remote code execution over HTTP or HTTPS via the Environment Management component, effectively compromising traditional boundary defenses. This emphasizes the need for immediate virtual patching or endpoint isolation.

2. Process Scheduler Inspection: Post-compromise activities often involve targeted scripts designed to extract database connection secrets from local configuration files—specifically the psappsrv.cfg file. This highlights the urgent need for comprehensive credential rotation.

3. Outbound Traffic Audits: Defenders must proactively analyze firewall logs and NetFlow data for any unusual outbound SMB or SSH connections. Attention should be paid to potential unauthorized MeshCentral management utility agents masquerading as legitimate cloud endpoints, which could signify a deeper compromise.

Carberry concluded with a pointed observation regarding Oracle’s long-standing licensing structure and its implications. He noted that while the company invested decades into developing its complex licensing model, it appears it fell short in implementing basic authentication for its core application management endpoints. This oversight might contribute to vulnerabilities that allow threat actors to exploit users without significant barriers.

With this alarming situation at hand, organizations are urged to take swift and robust action to prevent exposure to this recently uncovered vulnerability.

Source link