CVE-2026-35273

LLM-synthesized narrative grounded in this CVE's description and references.

• Oracle Corporation/Peoplesoft Enterprise Peopletools3 versions

  cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*+ 2 more

  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*
  • (no CPE)range: 8.61, 8.62

• www.cisa.gov/known-exploited-vulnerabilities-catalognvdThird Party AdvisoryUS Government Resource
• www.oracle.com/security-alerts/alert-cve-2026-35273.htmlnvdVendor Advisory

• ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
  The Hacker News · Jul 16, 2026
• Over 900 Oracle E-Business instances exposed to ongoing attacks
  BleepingComputer · Jul 1, 2026
• Nissan Traces Data Breach to PeopleSoft Zero-Day Exploit
  GovInfoSecurity · Jun 30, 2026
• Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day
  Infosecurity Magazine · Jun 30, 2026
• Nissan Employee Data Breached in Oracle PeopleSoft Hack
  SecurityWeek · Jun 30, 2026
• Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
  The Hacker News · Jun 30, 2026
• Nissan Confirms Data Breach Following Oracle PeopleSoft 0-Day Attacks
  Cyber Security News · Jun 30, 2026
• Nissan discloses employee data breach linked to Oracle zero-day attacks
  BleepingComputer · Jun 29, 2026
• NAIC says public data stolen in ShinyHunters' PeopleSoft breach
  BleepingComputer · Jun 29, 2026
• Hackers now exploit critical Oracle E-Business flaw in attacks
  BleepingComputer · Jun 29, 2026
• Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack
  SecurityWeek · Jun 29, 2026
• ZDI-26-389: Oracle PeopleSoft ExecuteProcessActivityCommand External Control of File Path Remote Code Execution Vulnerability
  Zero Day Initiative · Jun 24, 2026
• ZDI-26-388: Oracle PeopleSoft HubMBeanPersistance Deserialization of Untrusted Data Remote Code Execution Vulnerability
  Zero Day Initiative · Jun 24, 2026
• ZDI-26-387: Oracle PeopleSoft HttpListeningConnector Server-Side Request Forgery Vulnerability
  Zero Day Initiative · Jun 24, 2026
• Oracle June 2026 Critical Security Patch Update Addresses 243 CVEs (CVE-2026-35273)
  Tenable Blog · Jun 18, 2026
• PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM
  Trend Micro Research · Jun 18, 2026
• CISA Warns of Oracle PeopleSoft 0-Day Vulnerability Exploited in Ransomware Attacks
  Cyber Security News · Jun 17, 2026
• Oracle’s Second Monthly Security Updates Deliver 245 Patches
  SecurityWeek · Jun 17, 2026
• ShinyHunters Hits Universities Via Oracle Zero-Day
  GovInfoSecurity · Jun 16, 2026
• Council of Europe hacked in ShinyHunters' PeopleSoft heist
  The Register Security · Jun 15, 2026
• ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
  The Hacker News · Jun 15, 2026
• 15th June – Threat Intelligence Report
  Check Point Research · Jun 15, 2026
• Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack
  Help Net Security · Jun 14, 2026
• ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed
  Dark Reading · Jun 12, 2026
• ShinyHunters is actively extorting universities after exploiting an unpatched Oracle flaw
  CyberScoop · Jun 12, 2026
• Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
  Rapid7 Blog · Jun 12, 2026
• Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters
  SecurityWeek · Jun 12, 2026
• Oracle PeopleSoft 0-Day RCE Vulnerability Exploited in Attacks by ShinyHunters
  Cyber Security News · Jun 12, 2026
• Oracle CVE-2026-35273 Added to CISA KEV Under Active Ransomware Exploitation
  Vypr Intelligence · Jun 12, 2026
• ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
  The Hacker News · Jun 11, 2026
• Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
  BleepingComputer · Jun 11, 2026
• ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day
  The Register Security · Jun 11, 2026
• Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks
  SecurityWeek · Jun 11, 2026
• Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert
  Help Net Security · Jun 11, 2026
• Oracle Emergency Security Update to Fix Critical RCE Vulnerability
  Cyber Security News · Jun 11, 2026
• ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
  Mandiant Threat Intelligence · Jun 11, 2026
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA Alerts