---
title: ZDI: ShinyHunters' PeopleSoft CVE-2026-35273 is three bugs — PSIGW SSRF into PSEMHUB via default loopback trust, then web shell or XMLDecoder RCE | ctxsec
url: https://ctxsec.com/items/hunt-zdi-peoplesoft-cve-2026-35273-ssrf-loopback-rce
description: ""
status: "primary (TrendAI ZDI technical analysis, Oct 27); Oracle patched under CVE-2026-35273 June 10; Mandiant/GTIG attributed pre-patch exploitation to UNC6240/ShinyHunters"
published: 2026-10-28
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-zdi-peoplesoft-cve-2026-35273-ssrf-loopback-rce.md)

primary (TrendAI ZDI technical analysis, Oct 27); Oracle patched under CVE-2026-35273 June 10; Mandiant/GTIG attributed pre-patch exploitation to UNC6240/ShinyHunters

2026-10-28

### ZDI: ShinyHunters' PeopleSoft CVE-2026-35273 is three bugs — PSIGW SSRF into PSEMHUB via default loopback trust, then web shell or XMLDecoder RCE

TrendAI's Zero Day Initiative (Bobby Gould with Minh Giang and Lucas Miller) [broke down](https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) the flaw Oracle shipped as a single June 10 out-of-band ID, **CVE-2026-35273** (CVSS 9.8, PeopleTools 8.61/8.62). ZDI says it reported three distinct bugs across two WebLogic apps and is working with Oracle on separate CVEs.

- **PSIGW SSRF:** `HttpListeningConnector` lets an unauthenticated caller set the target URL and full payload for `HttpTargetConnector`.
- **PSEMHUB trust:** `allowedhosts.properties` ships with `127.0.0.1`, so SSRF to loopback passes `validateClient`.
- **RCE paths:** (1) write a JSP web shell via a log-write command that controls path and contents; (2) drop malicious XML that `XMLDecoder` deserializes on HubServlet init — quieter than a web shell.

Mandiant/GTIG attributed pre-patch exploitation (May 27–June 9) and a later wider wave to UNC6240 (ShinyHunters), mostly universities then other sectors. **Hunt:** PeopleSoft Integration Gateway and Environment Management Hub exposure; unusual POSTs to `/PSIGW/HttpListeningConnector`; new JSPs under the PeopleSoft context; unexpected XML under `envmetadata/data/environment/`; confirm June 10+ patch level.

Sources: [Zero Day Initiative: CVE-2026-35273 SSRF to RCE in Oracle PeopleSoft (Oct 27)](https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) · [Oracle Security Alert CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html) · [The Hacker News: ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (Oct 28)](https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html)