ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

A critical vulnerability in Oracle PeopleSoft, initially thought to be a single zero-day, has been revealed as three chained flaws. The vulnerability chain, tracked under CVE-2026-35273, has been actively exploited by the threat actor ShinyHunters since May 2026. Oracle patched all three flaws under a single CVE identifier in June 2026. The root cause is a server-side request forgery (SSRF) vulnerability that allows attackers to reach an internal management interface by exploiting PeopleSoft's trust of its own loopback address. Researchers who reported the vulnerabilities disclosed the chained nature of the exploit this week, highlighting the complexity of the attack vector.