PeopleSoft zero-day CVE-2026-35273: the attack came first

Most patch advice assumes the fix exists before the attack. Oracle PeopleSoft CVE-2026-35273 breaks that assumption: attackers were exploiting it in the wild for two weeks before Oracle even shipped a patch. If your HR or student-records system runs PeopleSoft, this is the case study for why "we patch on schedule" is necessary but not sufficient.

What actually happened

Per Oracle's out-of-band security alert and Rapid7, CVE-2026-35273 is a CVSS 9.8 flaw in PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62), in the Updates Environment Management component. The details that matter:

• Pre-auth remote code execution. It's remotely exploitable with no authentication — a server-side request forgery that becomes code execution. HTTP access to the box is the whole barrier to entry.
• The exploit beat the patch. Oracle disclosed the flaw and shipped an out-of-band fix on June 10, 2026. But active exploitation was observed May 27–June 9 — roughly two weeks earlier. This was a true zero-day.
• Who and how many. The financially-motivated group ShinyHunters (UNC6240) ran the campaign, notifying 100+ organizations — 68% of them universities and colleges — per Arctic Wolf. Post-exploitation, attackers deployed MeshCentral remote-management agents disguised as "Microsoft Azure" services to keep their foothold.

Why it matters for your business

Two things make this the wrong bug to shrug off. First, PeopleSoft is where the sensitive data lives — payroll, SSNs, student and employee identity records. Second, the exploit arrived before the patch, so the companies that "wait for the next cycle" were already breached by the time the fix existed. Patch cadence is a floor, not a ceiling.

The operator takeaways go beyond "patch fast," because fast wasn't enough here:

• Reduce exposure. Keep HR, ERP, and identity systems off the open internet — behind a VPN or IP allowlist. A global scan can't exploit what it can't reach. Oracle's own compensating controls include disabling the Environment Management Hub and blocking external access to /PSEMHUB/*.
• Assume you can't out-patch a zero-day; detect the aftermath. The tell here was a rogue remote-management agent masquerading as Azure. You want alerting on new admin tools and outbound connections, not just a patch log.
• Know your inventory. You can't defend a PeopleSoft instance you forgot was internet-facing.

None of that is glamorous. All of it beats explaining why your payroll system got popped by a bug with no patch.

Sources: Oracle Security Alert, Rapid7, Arctic Wolf.