On October 27, 2026, the Zero Day Initiative (ZDI) published a technical analysis describing three linked flaws behind Oracle PeopleSoft’s CVE-2026-35273: a server-side request forgery (SSRF) in PeopleSoft Integration Gateway (PSIGW), followed by either of two routes to remote code execution (RCE) in PeopleSoft Environment Management Hub (PSEMHUB). Oracle’s alert for the vulnerability, dated June 10, 2026, lists PeopleTools 8.61 and 8.62 as affected.

Three tracked flaws, one public CVE

ZDI describes three vulnerabilities across PSIGW and PSEMHUB, grouped under Oracle’s public identifier CVE-2026-35273. Its labels for the individual flaws are ZDI-CAN-31816, ZDI-CAN-31818, and ZDI-CAN-31817. These are ZDI tracking labels, not separate CVE numbers; ZDI says it is coordinating with Oracle on distinct CVE assignments.

Oracle rates CVE-2026-35273 9.8 under CVSS 3.1. Its risk matrix lists a network attack vector, low attack complexity, no privileges required and no user interaction, with high impacts to confidentiality, integrity and availability.

How the SSRF reaches the internal hub

An SSRF makes a server send a request to a destination chosen by an attacker. ZDI says the flaw is in PSIGW’s HttpTargetConnector, which allows a request to specify its destination URL and the content forwarded to it.

The request can reach PSEMHUB because its default allowed-hosts configuration trusts 127.0.0.1, the loopback address used for local agent communication. ZDI says the SSRF can make a request appear to come from that trusted local address, bringing the internal hub within reach.

Two alternative routes to code execution

A branching diagram traces a request from a PSIGW SSRF through 127.0.0.1 to PSEMHUB, then splits into file-path control and XMLDecoder code-execution routes.

After the SSRF reaches PSEMHUB, ZDI describes two different vulnerabilities that can lead to RCE. They are alternative routes, not two steps that both have to occur:

  • File-path control: PSEMHUB’s ExecuteProcessActivityCommand accepts caller-controlled file content and an absolute destination path. ZDI says this flaw can be used to write a web shell.
  • Unsafe XML deserialization: During initialization, PSEMHUB’s HubServlet reads XML files from its environment data directory with Java’s XMLDecoder. ZDI says code can execute while the XML is being decoded, before a later cast to the expected Environment type fails. The trigger is initialization, including after a service or system restart.

PeopleTools versions in Oracle’s alert

Oracle lists PeopleSoft Enterprise PeopleTools 8.61 and 8.62 as affected. Oracle says earlier versions were not tested for these vulnerabilities and are likely also affected. The alert says mitigations and patches are supplied only for product versions in Premier Support or Extended Support, and recommends upgrading to a supported version.

Oracle’s June 10, 2026 Security Alert for CVE-2026-35273 contains the vendor’s mitigation and patch guidance.

The reported exploitation period

The Hacker News reported on October 28, 2026, that Mandiant and Google Threat Intelligence Group attributed exploitation of the vulnerability from May 27 through June 9, 2026, to UNC6240, also known as ShinyHunters. That reported activity preceded Oracle’s June 10 alert; the later ZDI analysis explains the three flaws behind the CVE.