The ShinyHunters extortion group has used a critical zero-day vulnerability in Oracle PeopleSoft to steal data from potentially more than 100 organizations.
According to research from Mandiant and Google Threat Intelligence Group, the group exploited a flaw in Oracle PeopleTools, the underlying runtime and development platform used by PeopleSoft environments. The vulnerability is tracked as CVE-2026-35273 and carries a critical CVSS score of 9.8.
The issue allowed unauthenticated remote code execution through the Environment Management Hub, also known as EMHub, a backend PeopleSoft service used to manage agents across PeopleSoft environments.
The campaign reportedly ran from May 27 to June 9, 2026, and appears to have heavily affected higher education organizations.
Why PeopleSoft Is a High-Value Target
PeopleSoft is widely used by large organizations for enterprise resource planning and administration.
Its common use cases include:
- payroll
- human resources
- supply chain management
- finance operations
- student administration
- employee records
- institutional administration
Because PeopleSoft often stores sensitive personal, financial, and operational data, it is an attractive target for extortion groups.
A successful compromise can expose:
- employee records
- student records
- payroll data
- HR files
- financial information
- identity data
- internal business records
- administrative documents
For universities, government bodies, and large enterprises, PeopleSoft can be one of the most sensitive systems in the environment.
What Is CVE-2026-35273?
CVE-2026-35273 is a critical remote code execution vulnerability in PeopleTools.
The flaw is located in Environment Management Hub, a backend component used to track and manage agents across PeopleSoft environments.
According to Mandiant and Google Threat Intelligence Group, the vulnerability could be exploited without authentication.
That makes the issue especially dangerous.
An unauthenticated RCE vulnerability means an attacker does not need valid credentials to begin executing code on a vulnerable system. If the vulnerable service is exposed, exploitation can be fast and highly damaging.
Oracle has since patched the flaw and issued a security advisory.
How ShinyHunters Exploited the Flaw
ShinyHunters began exploiting CVE-2026-35273 on May 27, 2026, targeting global organizations running vulnerable PeopleSoft environments.
The group claimed to have compromised more than 300 PeopleSoft instances across more than 100 organizations.
Mandiant and Google notified more than 100 organizations with potentially vulnerable endpoints.
Researchers were able to reconstruct parts of the attack because the threat actors accidentally left several directories exposed on the open internet.
Those exposed directories revealed details about the group’s tooling, infrastructure, and post-exploitation workflow.
Tools Used in the Campaign
The attackers used a combination of remote management, reconnaissance, credential attack, and data exfiltration tools.
MeshCentral for Command and Control
ShinyHunters used MeshCentral, an open-source browser-based remote management platform, for command-and-control operations.
To make the activity look less suspicious, the attackers named MeshCentral agents after Microsoft Azure services.
This kind of naming camouflage is common. Attackers often disguise malicious tools as cloud, update, or system services to avoid quick detection.
Reconnaissance Through MeshCentral CLI
The group used MeshCentral’s command-line interface to perform reconnaissance on compromised environments.
This likely helped identify data stores, accessible systems, credentials, and paths for further movement.
SSH Credential Spraying
The attackers also used a custom SSH credential spraying script to spread deeper into victim environments.
Credential spraying involves trying known or likely credentials across multiple systems. In an environment where passwords are reused or weakly protected, this can expand access quickly.
Zstandard for Data Exfiltration
The group used the Zstandard compression algorithm to compress and exfiltrate large volumes of stolen data.
Compression helps attackers move data more efficiently and may reduce the size of transfers that defenders need to inspect.
Higher Education Heavily Affected
Of the organizations contacted by Google, most were based in the United States, and 68% were involved in higher education.
This is significant because universities often run large, complex PeopleSoft environments that contain sensitive student and staff data.
The University of Nottingham in the United Kingdom confirmed it was among the impacted organizations, reporting that a significant amount of data was stolen from its student records system.
ShinyHunters also listed the university on its leak site, claiming to possess more than 40 GB of sensitive data.
The university confirmed that current and former students were affected, although it did not publicly specify exactly what types of data were stolen.
ShinyHunters’ Continued Focus on Education
This campaign fits a broader pattern of ShinyHunters targeting the education sector.
The group has previously been tied to attacks involving Instructure, the company behind the widely used Canvas learning management platform.
Instructure was breached last September and reportedly suffered another disruption this spring, later announcing that it had reached an agreement with the threat actors.
The PeopleSoft campaign reinforces the reality that education remains a prime target for extortion groups.
Universities often hold valuable data, operate open and distributed networks, and rely on legacy enterprise systems that can be difficult to patch quickly.
Why EMHub Exposure Matters
Mandiant and Google emphasized that organizations should disable or restrict access to EMHub where possible.
The key point is that EMHub is not required for core user-facing PeopleSoft Internet Architecture browser sessions.
That means many organizations may be able to block external access or disable the service without breaking normal PeopleSoft user access.
This is an important mitigation because internet-exposed backend management services often create unnecessary risk.
If a service does not need to be externally reachable, it should not be exposed.
Web Application Firewalls Are Not Enough
Researchers noted that some vulnerable organizations had web application firewalls protecting their environments.
WAFs may help reduce some exploit attempts, but they should not be treated as a durable fix.
Attackers can often modify payloads to bypass WAF rules, especially when a vulnerability is valuable and actively targeted.
Oracle’s patch and recommended mitigations remain the priority.
A WAF can be part of a defense-in-depth strategy, but it should not replace patching, service restriction, or exposure reduction.
What Organizations Should Do Now
Organizations running PeopleSoft should act immediately.
Recommended steps include:
- apply Oracle’s patch for CVE-2026-35273
- identify all PeopleSoft and PeopleTools deployments
- determine whether EMHub is enabled
- disable EMHub if it is not required
- block external network access to EMHub
- restrict EMHub access to trusted administrative networks only
- review logs for activity between May 27 and June 9, 2026
- search for MeshCentral agents or related remote management artifacts
- investigate suspicious service names resembling Microsoft Azure services
- review SSH login attempts and credential spraying patterns
- look for large compressed data archives
- monitor for Zstandard usage in unusual locations
- check for unexpected outbound data transfers
- rotate credentials associated with PeopleSoft environments
- review privileged accounts and service accounts
Any exposed PeopleSoft environment should be treated as high risk until patched and reviewed.
What to Hunt For
Security teams should hunt for signs of post-exploitation activity.
Potential indicators include:
- unexpected MeshCentral installations
- MeshCentral agents using Azure-like names
- unusual command-line activity from PeopleSoft servers
- SSH login failures across multiple internal systems
- successful SSH access from unexpected sources
- Zstandard compression tools in unusual paths
- large compressed files created shortly before outbound transfer
- unusual outbound connections from PeopleSoft servers
- new services or scheduled tasks
- suspicious administrative accounts
- unexplained data access from student, HR, or payroll systems
Because ShinyHunters is an extortion group, defenders should also watch for signs of data staging and exfiltration.
Lessons From the Campaign
This campaign highlights several important lessons.
First, ERP systems are high-value targets. They often contain the data attackers want most.
Second, backend management services can create serious exposure if left reachable from the internet.
Third, unauthenticated RCE vulnerabilities in enterprise platforms can be weaponized quickly.
Fourth, WAFs should not be treated as permanent fixes for critical vulnerabilities.
Fifth, education organizations remain especially attractive to extortion groups because of the type and volume of data they manage.
Finally, incident response must look beyond patching. If exploitation may have occurred, organizations need to investigate access, persistence, lateral movement, credential theft, and data exfiltration.
Why ERP Security Needs More Attention
PeopleSoft is not just another business application. It often acts as a system of record.
In many organizations, it contains sensitive data about employees, students, suppliers, payroll, benefits, operations, and finance.
That makes it a priority target.
ERP security should include:
- strict exposure management
- continuous vulnerability monitoring
- regular patching
- segmentation
- privileged access controls
- service account review
- logging and alerting
- data access monitoring
- incident response planning
- third-party security review
Systems that store sensitive administrative data need the same level of protection as identity platforms, databases, and financial systems.
Final Thoughts
The ShinyHunters campaign against Oracle PeopleSoft shows how quickly a critical enterprise zero-day can turn into a global data theft operation.
By exploiting CVE-2026-35273 in PeopleTools EMHub, the group gained unauthenticated remote code execution against vulnerable environments and reportedly compromised hundreds of PeopleSoft instances.
Higher education appears to have been heavily affected, with the University of Nottingham confirming a significant data breach involving its student records system.
Organizations running PeopleSoft should patch immediately, disable or restrict EMHub, review exposure, and investigate for signs of MeshCentral, SSH credential spraying, compressed data staging, and exfiltration.
For defenders, the message is clear: ERP platforms are not back-office systems from a security perspective. They are crown-jewel data stores, and attackers know it.
