Imagine finding out that someone has been accessing your organization’s systems, stealing data, and moving between servers without anyone noticing. That’s the kind of situation organizations faced when ShinyHunters exploited a critical vulnerability in Oracle PeopleSoft.
The attacks took place from May 27 to June 9, 2026, before Oracle issued its security alert. Universities were among the hardest hit, with some organizations suffering data breaches.
How did the attackers get in, what should Oracle PeopleSoft users check, and what are the signs of compromise to look for?
How Did the Attack on Oracle PeopleSoft Happen?
CVE-2026-35273 affects Oracle PeopleTools 8.61 and 8.62 and has a critical CVSS score of 9.8.
The problem lies in the Updates Environment Management component, which is associated with the Environment Management Hub and the PSEMHUB application.
To put it simply, the vulnerable component fails to appropriately verify that an individual is authorized to access it. Without logging in, an attacker may be able to execute commands on the compromised system if they can connect to the endpoint via HTTP.
Attackers can exploit the exposed endpoint remotely without stolen passwords or user interaction.
On June 10, 2026, Oracle issued an alert, and on June 12, CISA added the vulnerability to its KEV Catalog[3].
Getting In Was Only the Beginning
What happened after the initial access is just as important as the vulnerability itself.
Mandiant’s investigation uncovered tools and scripts that showed how the attackers tried to maintain access, reach other systems, and steal information.
Here’s what they found.
1. Remote access tools disguised as legitimate software
The attackers deployed customized MeshCentral agents disguised as Microsoft Azure-related software. This gave them a way to access compromised systems remotely without relying on the original vulnerability every time.
2. Attempts to move across internal systems
Investigators found a script designed to connect to other hosts over SSH using a hardcoded list of usernames and passwords. This is called lateral movement. Once attackers get into one system, they look for ways to reach other systems connected to it.
3. Data collection and theft
Attackers sent stolen data to servers connected to ShinyHunters after compressing it.
4. Extortion using stolen information
Data associated with the campaign later appeared on the group’s leak site. For affected organizations, that meant the incident wasn’t just about fixing a vulnerable server. Their sensitive information could also be exposed.
Universities were hit particularly hard. Mandiant reported[4] notifying more than 100 organizations whose IP addresses matched potentially vulnerable endpoints. Around 68% were in higher education, most of them in the United States. Some organizations blocked the activity, while others were compromised.
The University of Nottingham confirmed a cyberattack[5]. The exposed data could affect current and former students, with consequences beyond the university’s IT systems.
How Can You Tell If ShinyHunters Have Been in Your Environment?
Patching the vulnerability is important, but there’s another thing organizations need to check: did attackers get in before the fix was applied?
That’s why security teams should look for signs of compromise rather than assuming the problem is solved once the vulnerable component is secured.
Here are some things worth investigating:
Suspicious requests:
Check PeopleSoft and WebLogic logs for unexpected POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector.
Unfamiliar JSP files:
Look for unexpected files such as x.jsp, u.jsp, tunnel.jsp, and tunnel.jspx in the PSEMHUB.war directory.
Unknown remote access tools:
Investigate unfamiliar MeshCentral agents and executables disguised as legitimate software.
Unusual SSH activity:
Check for unexpected connections from PeopleSoft servers to other internal systems.
Suspicious outbound traffic:
Look for unusual data transfers and connections that could indicate data staging or exfiltration.
There’s another detail to keep in mind. Attackers may use different URLs to bypass security tools.
In September 2026, attackers used encoded paths like /%50SEMHUB/hub to bypass some WAF rules and reach the vulnerable endpoint.
So, blocking the standard URL alone may not be enough. Security teams should also review how their WAF rules handle encoded paths.
What Should You Do If You Use Oracle PeopleSoft?
If you use PeopleSoft, check your PeopleTools version and whether the Environment Management Hub is exposed.
Oracle recommends applying the appropriate security fixes. Its guidance also includes disabling the Environment Management Hub in multi-server configurations or removing the PSEMHUB application in single-server configurations, as applicable.
If you can’t disable or remove the component immediately, restrict external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector.
You can find the official instructions in Oracle’s security alert for CVE-2026-35273.
And don’t forget to check for signs of an earlier compromise. Check logs, suspicious files, and unusual connections. If you find anything, investigate whether attackers accessed other systems or stole data.
The important thing is to address both problems: the vulnerability itself and any attacker who may already have used it.
Why Visibility Matters After an Attack
The ShinyHunters attack shows how attackers can gain access, spread to other systems, and steal data.
That’s why security teams need to see more than the initial alert. They need to connect activity across networks, endpoints, and cloud environments to understand what happened and where an attacker may have gone next.
Fidelis Elevate® helps security teams correlate suspicious activity and investigate potential post-breach attacks. It brings together network security, deception, and Active Directory protection to support proactive cyber defense.
Download the Fidelis Elevate® data sheet to learn more about its threat detection and investigation capabilities.
Final Thoughts
One exposed vulnerability can result in a much larger incident, as seen in the ShinyHunters attack on Oracle PeopleSoft. The reported activity included lateral movement, data theft, and remote access tools after the group took advantage of a vulnerability that permitted remote access without authentication.
Apply Oracle’s suggested fixes and look for indications of compromise if you are using an impacted version of PeopleSoft.
Because getting the vulnerability fixed is important. But making sure nobody is still inside your systems is just as important.
Our customers detect post-breach attacks over 9x Faster
Detect Advanced Threats Before Damage Escalates TrustedCybersecurity Leader for 20+ YearsSee why security teams choose us over other solutionsSee Fidelis Elevate in Action
Citations:
The post ShinyHunters Exploits Oracle PeopleSoft to Steal Sensitive Data appeared first on Fidelis Security.
No Responses