Oracle published an alert for CVE-2026-35273, a PeopleTools vulnerability exploitable remotely without authentication and capable of remote code execution. In September 2026, Google Threat Intelligence described a new exploitation phase by UNC6240, associated with ShinyHunters.
What the sources establish
Oracle’s matrix describes a network-exploitable flaw requiring no privileges and recommends prompt action. Google Threat Intelligence observed a renewed mass-exploitation campaign and says the attacker bypassed some WAF filters by encoding the PSEMHUB path as /%50SEMHUB/.
The presence of a campaign does not mean every PeopleSoft server was compromised. It does justify a rapid inventory of exposed versions and access controls.
The PeopleTools scope
List PeopleSoft, PeopleTools, development environments and interfaces reachable from the Internet. Oracle identifies PeopleTools 8.61 and 8.62 in its matrix; check the exact version, applicable fix and support status of each installation. Pay particular attention to the PSEMHUB path. A WAF rule that blocks only the literal /PSEMHUB/ path is not enough: encoded variants may bypass it.
Include directory, database, payroll, finance and transfer connections. A compromised application server can make integration secrets more important than the web interface alone.
Patch and search for evidence
Apply Oracle’s fix promptly: a WAF filter is not a substitute. If EMHub is not needed, follow Oracle and Mandiant guidance to disable it in a multi-server configuration or remove the PSEMHUB application in a single-server configuration. In WebLogic/PIA logs, search for /PSEMHUB/ and encoded variants such as /%50SEMHUB/, especially POST requests to /hub, as well as unexpected .jsp or .jspx files. Inspect affected PeopleSoft nodes and preserve evidence before reinstalling or deleting files.
A patch fixes the vulnerability; it does not automatically revoke sessions, API keys or passwords that may have been read.
Credentials to rotate
Inventory secrets readable by the PeopleSoft service account, including database connection strings, Integration Broker credentials and cloud credentials reachable from the web server. After preserving evidence and based on the investigation, revoke sessions and rotate these secrets and any other exposed credentials.
Also watch urgent reset requests: a known campaign can be followed by impersonation attempts targeting HR and finance teams.
How Soclyde fits
Soclyde does not patch PeopleSoft or detect an intrusion. It can help keep administrator and integration access in a local-first encrypted vault, with distinct credentials that can be found during rotation.
That organization supports operational response without replacing Oracle fixes, logs or forensic assessment.
Key takeaway
CVE-2026-35273 exposes PeopleTools to unauthenticated RCE and is part of a campaign described by Google. Inventory, patch, search for evidence and rotate secrets where needed. See the secure password generator or contact Soclyde.
For handling shared access with clear sharing and revocation rules, see our guide to secure team password sharing.
