IntelliOSPANDAModule|AICVE Watch BriefOracle PeopleSoft Environment Management Hub unauthenticated remote code execution
| Research field | Finding / method |
|---|---|
| Decision question | Which PeopleSoft PeopleTools systems exposed Environment Management Hub while vulnerable, which received the correct Oracle customer patch or mitigation, and which need compromise assessment because zero-day exploitation, data theft, and extortion are confirmed? [1][2][3][8] |
| Interpreted questions | Scope, exact supported-release boundary, customer-specific patch proof, HTTP reachability, PSEMHUB configuration, exploitation window, actors and victims, concrete IOCs, local evidence, data and identity blast radius, recovery trust, and notification obligations. |
| Tier 0 | Oracle, Mandiant/GTIG, CISA KEV and BOD guidance, NVD, and the canonical CVE record retained for controlling facts. [1][2][3][4][5][8] |
| Tier 1 | ZDI, MITRE CWE, and Oracle product/update documentation retained for technical and taxonomy context. [6][7][9][10] |
| Tier 2 | High-value practitioner and national-CSIRT research checked for discovery; no claim outranked the retained primary campaign and vendor sources. |
| Tier 3 | Security news checked for leads and named disclosures; not used to control scope, exploitation, attribution, or impact. |
| Tier 4 | Community and social claims checked only as leads; unverified victim counts, exploit code, and actor claims excluded. |
| Tier 5 | No user-defined custom source was supplied. |
| Tier 6 | No private integration, credentialed feed, or keyed telemetry was queried. |
| Tier 7 | Carved Oracle product documentation retained to explain EMHub architecture and update operations, not as incident evidence. [9] |
| Tier 8 | Expansion research tested public-PoC, victim, patch-level, and IOC questions; unsupported or account-gated claims were preserved as unknowns. |
| Decision standard | Fact, source-owned assessment, local inference, and unknown remain separate. Affected is not exposed; exposed is not exploited; patched is not clean; an IOC match is not attribution; no match does not rule out changed infrastructure. |
| Research cutoff | 9 Aug 2026, America/New_York. Oracle’s 10 June disclosure, GTIG’s 11 June campaign report, CISA’s 12 June KEV action, and NVD’s 23 July modification are reconciled. [1][2][3][4] |
| Decision field | Current answer | Owner implication |
|---|---|---|
| Affected scope | Supported PeopleTools 8.61 and 8.62; Oracle says earlier unsupported releases are likely affected but untested. [1][4] | Inventory production, test, DR, hosted, and single-/multi-server PIA environments. |
| Fixed state | Oracle released a June 10 patch path for both supported branches; public pages do not enumerate fixed patch-level numbers. The authoritative exact fix is the branch-specific My Oracle Support patch referenced by the alert. [1][10] | Record MOS patch ID, prerequisite, install result, restart, and post-change version for every instance. |
| Exploitation / KEV | GTIG observed exploitation 27 May–9 Jun; CISA added KEV 12 Jun with a 15 Jun due date. [2][3] | The deadline is past; historically reachable systems require patch proof plus forensic triage. |
| Observed impact | Some organizations were compromised and stolen data was published; the campaign used data theft, extortion markers, lateral movement, and remote administration. [2] | Scope data, credentials, storage, integrations, and dependent parties—not only the web host. |
| Severity / weakness | Oracle CVSS 3.1 9.8 Critical; CISA-ADP CWE-306. ZDI separately describes deserialization in HubMBeanPersistance. [1][4][6][7] | Prioritize by historical reachability and trust concentration; do not merge different scoring methods. |
| Ransomware / actor | CISA marks known ransomware campaign use; GTIG attributes the compromise-and-extortion campaign to UNC6240 (ShinyHunters). [2][3] | Treat extortion risk as confirmed campaign context while keeping encryption and local attribution separate. |
| Concrete evidence | Five staging IPs, one C2 domain and WebSocket URL, filenames, four payload hashes, command history hash, endpoint paths, and behaviors are public. [2] | Load time-bounded indicators and correlate them with product, network, host, identity, and data evidence. |
CVE-2026-35273 is a critical Oracle PeopleSoft Enterprise PeopleTools vulnerability in Updates Environment Management. Oracle says an unauthenticated network attacker can reach it through HTTP—including HTTPS under Oracle’s protocol convention—and achieve PeopleTools takeover or remote code execution. Supported 8.61 and 8.62 releases are affected, and Oracle warns older unsupported releases are likely affected but were not tested. [1][4][5]
This is a continuing CVE Watch because exploitation preceded disclosure. Mandiant and GTIG observed PSEMHUB-targeted compromise from 27 May through 9 June, attribute the campaign to UNC6240/ShinyHunters, and document data theft and extortion. CISA then added the issue to KEV. [2][3]
| Audience | Decision | Proof required |
|---|---|---|
| Executive / business owner | Keep service online, isolate, or invoke continuity and incident response. | Instance count, historical exposure, patch/mitigation evidence, impact findings, affected workflows, recovery option, and accountable owner. |
| PeopleSoft / infrastructure | Apply the correct MOS patch, disable or remove EMHub where applicable, and restrict administrative endpoints. | Branch, MOS patch ID, prerequisites, install logs, PSEMHUB state, route tests, and service validation. |
| SOC / DFIR | Classify attempt, likely compromise, confirmed compromise, and blast radius. | Preserved PIA access logs, WebLogic and filesystem artifacts, process, EDR, network, identity, database, storage, and integration evidence. |
| Legal / privacy / insurance | Determine notice, coverage, privilege, law-enforcement, and communications actions from verified impact. | Timeline, data and people affected, acquisition/publication evidence, containment, provider notices, and source-qualified statements. |
Oracle PeopleSoft commonly anchors sensitive HR, payroll, finance, student, identity, and administrative workflows. CVE-2026-35273 turns exposure of the Environment Management Hub into an enterprise-application trust problem: a remotely reachable attacker needs no valid account, and successful exploitation can produce PeopleTools takeover and remote code execution. The risk therefore extends beyond the web tier to credentials, databases, storage, integrations, scheduled processes, and every party that relies on the environment. [1][2][9]
Oracle released an out-of-band Security Alert on 10 June 2026 for the Updates Environment Management component. Supported PeopleTools 8.61 and 8.62 are affected. Oracle also warns that earlier unsupported releases were not tested but are likely affected and should be upgraded to a supported version. The Oracle risk matrix assigns CVSS 3.1 9.8 with network attack vector, low complexity, no privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts. [1][4][5]
The public advisory links branch-specific patch documentation in My Oracle Support but does not enumerate an exact fixed PeopleTools patch level or build number. That is an evidence boundary, not permission to describe all 8.61 or 8.62 systems as fixed. Owners must retain the exact MOS patch identifier, prerequisites, install output, restart evidence, and post-change validation for each instance. Oracle’s June Critical Security Patch Update says its PeopleTools update includes the alert patch plus additional fixes. [1][10]
Mandiant and GTIG observed exploitation from 27 May through 9 June and linked it directly to PSEMHUB endpoints, making this a zero-day campaign. They attribute the active compromise and extortion activity to UNC6240, associated with ShinyHunters. GTIG notified more than 100 organizations whose IPs correlated with potentially vulnerable endpoints; most were U.S.-based and 68 percent were higher-education organizations. Those figures describe the notification population, not a verified global victim count. [2]
The observed attack path was concrete. Operators used five staging hosts serving materials on TCP 8888, customized MeshCentral agents masquerading as Azure services, and C2 at `wss://azurenetfiles.net:443/agent.ashx`. They inspected PeopleSoft and WebLogic configuration, used `meshctrl.js`, deployed a victim-specific fanout script, sprayed SSH credentials, placed a defacement/extortion marker, compressed collected data with zstd, and connected to `176.120.22.24`, which GTIG identified as the public ShinyHunters leak-site mirror. [2]
Detection must combine exact indicators with behavior and product context. Review external POSTs to `/PSEMHUB/hub` and `/PSIGW/HttpListeningConnector`, SSRF-like loopback or internal values, unexpected JSP files under `PSEMHUB.war`, content under `envmetadata/transactions`, suspicious `logs`, `persistantstorage`, or `scratchpad` directories, recently changed XML in `envmetadata/data/environment`, outbound SMB, MeshCentral execution, SSH spraying, zstd archives, and the published hashes and filenames. Indicator absence cannot rule out exploitation because infrastructure can change. [2]
CISA added the CVE to KEV on 12 June with a compressed 15 June due date and requires vendor mitigation plus applicable BOD 26-04 forensic triage. The catalog marks known ransomware campaign use. GTIG documents data theft, extortion, and stolen-data publication for some organizations, but the retained primary sources do not establish encryption malware as an observed impact. Use the ransomware field for prioritization while keeping encryption, actor identity, and local incident conclusions evidence-specific. [2][3][8]
Immediate action is to apply the correct Oracle patch, reduce external administrative exposure, preserve evidence, hunt across the full historical window, contain suspicious tiers, and rotate or revoke plausibly exposed trust. Rebuild or restore from trusted state if integrity cannot be established. SMBs and organizations without direct PeopleSoft ownership should still query payroll, education, insurance, government, and managed-service dependencies for instance-specific patch and investigation evidence. [1][2][3]
| Risk concentration | Why it matters | Decision consequence |
|---|---|---|
| Unauthenticated enterprise-app entry | Network reachability alone can satisfy the public precondition; no stolen account or user action is required. | Prioritize historical reachability, not only current internet scans. |
| Concentrated regulated records | PeopleSoft can hold employee, payroll, finance, benefits, student, and identity data. | Scope actual databases, attachments, reports, exports, and people before impact statements. |
| Connected administrative trust | Observed operators mapped configuration, sprayed SSH credentials, and accessed storage and remote agents. | Review service accounts, keys, shares, schedulers, databases, and integrations. |
| Data-theft extortion | Published campaign impact includes stolen data, markers, and leak-site publication for some organizations. | Prepare privacy, legal, communications, insurer, and law-enforcement workstreams without assuming encryption. |
| Field | Current finding | Interpretation limit |
|---|---|---|
| Identifier / component | CVE-2026-35273 in PeopleSoft Enterprise PeopleTools, Updates Environment Management / Environment Management Hub. [1][4][5] | Do not generalize every PeopleSoft component or cloud service as vulnerable. |
| Reachability | Remote, unauthenticated HTTP access; Oracle’s convention includes HTTPS. [1] | Local exposure still depends on route, proxy, firewall, and component configuration. |
| Technical detail | ZDI describes insufficient validation in `HubMBeanPersistance` leading to deserialization of untrusted data and service-account code execution. [6] | ZDI's separate 7.5 score and authenticated-language framing should not replace Oracle's CNA scope or CVSS. |
| Impact | Oracle says takeover; GTIG documents real compromise, data theft, lateral movement, extortion, and publication for some organizations. [1][2] | Capability and campaign outcomes do not prove the same impact in every environment. |
| Public exploit | No retained primary source establishes a complete public proof-of-concept release. [1][2][3][4][6] | This does not prove code is unavailable anywhere and does not reduce urgency after confirmed exploitation. |
Exact affected supported versions: Oracle lists PeopleSoft Enterprise PeopleTools 8.61 and 8.62. These are release branches, not proof that every later patch level is vulnerable after the customer applied the June security patch. Oracle also says unsupported earlier releases were not tested but are likely affected and should be upgraded to a supported version. PeopleSoft Enterprise Applications customers may be affected when their stack includes the vulnerable PeopleTools component. [1][4][5]
Exact fixed-state evidence: Oracle released patches and mitigations for the supported branches through the 10 June Security Alert and links the authoritative PeopleSoft Patch Availability Document in My Oracle Support. Oracle’s public advisory does not publish fixed patch-level or build numbers. Accordingly, this brief does not fabricate a version such as “8.61.x+” or “8.62.x+.” A system is treated as fixed only when its owner can identify the applicable MOS patch ID for the branch, prove prerequisites and installation, document any restart, and validate the component after change. [1]
June update relationship: Oracle’s 16 June Critical Security Patch Update states that the PeopleTools update includes patches for this alert plus additional fixes. Customers should follow Oracle’s branch-specific instructions and support status, not substitute a general date or base release label for patch proof. If the required patch is unavailable for an unsupported release, upgrade to a supported release or discontinue/exclude exposure until a supported mitigation is in place. [1][10]
| Dimension | Evidence | Operational use |
|---|---|---|
| Oracle CVSS 3.1 | 9.8 Critical — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. [1][4][5] | Base technical severity; not a local exposure or loss score. |
| CISA SSVC | Active exploitation, automatable “yes,” technical impact “total.” [4] | Supports compressed action timing; does not prove local compromise. |
| Observed campaign | Zero-day use, data theft, lateral movement, extortion, and publication for some organizations. [2] | Elevates reachable or historically exposed systems to incident-triage priority. |
| Priority rule | Internet-reachable or untrusted-network-reachable PSEMHUB during the observed window ranks ahead of isolated, proven-patched instances. | Combine reachability, data concentration, service-account privilege, compensating controls, and evidence quality. |
CISA-ADP assigns CWE-306, Missing Authentication for Critical Function. The class fits the authoritative Oracle description: a remote network attacker does not need credentials to invoke security-relevant functionality that can produce takeover. CWE is a weakness taxonomy, not an exploit recipe, and it does not identify the precise request body, all vulnerable methods, persistence, or local impact. [4][7]
ZDI later describes a deserialization flaw in `HubMBeanPersistance`. That technical detail can coexist with CWE-306 because a vulnerability may involve both an exposed critical function and unsafe data handling, but only CWE-306 appears in the retained CISA/NVD record. Do not replace the canonical mapping or combine scoring vectors without explaining provenance. [4][6]
| Status field | Authoritative answer | Boundary |
|---|---|---|
| CISA KEV | Yes; added 12 Jun 2026. [3][4] | KEV confirms exploitation somewhere, not compromise of a named organization. |
| Required-action date | 15 Jun 2026; vendor mitigation plus applicable BOD 26-04 forensics triage. [3][8] | The federal deadline is past; other organizations should use it as urgency evidence, not misstate legal applicability. |
| Observed exploitation | 27 May–9 Jun 2026 against PSEMHUB endpoints, predating disclosure. [2] | Public observation does not prove activity stopped after 9 June. |
| Known ransomware use | Known in CISA KEV; GTIG documents data-theft extortion and leak-site publication. [2][3] | The retained evidence does not establish encryption malware as an observed campaign outcome. |
| Actor | Mandiant/GTIG attributes the campaign to UNC6240, associated with ShinyHunters. [2] | Attribution is source-owned and campaign-level; an IOC match alone is insufficient for local attribution. |
| Victim status | GTIG notified more than 100 potentially exposed organizations and confirms compromise/publication for some. [2] | Notifications are not confirmed victims, and the report does not provide a complete victim census. |
| Public exploit | No complete public PoC is established by the retained primary sources. | Unknown is not no; confirmed exploitation makes PoC availability immaterial to priority. |
| Stage | Observed / authoritative record | Defender question |
|---|---|---|
| Precondition | An affected PeopleTools release exposes Updates Environment Management over HTTP(S); no authentication or user interaction is required. [1][4] | Was PSEMHUB reachable from the internet, partners, VPN users, or another untrusted zone? |
| Initial access | GTIG saw targeting aligned to `POST /PSEMHUB/hub` and an SSRF-related Integration Broker path. [2] | Which untrusted sources reached either endpoint, including through reverse proxies? |
| Execution / persistence | Unexpected JSP and XML artifacts may support code execution or restart-triggered XMLDecoder behavior; MeshCentral agents provided remote administration. [2][6] | What files, child processes, and outbound sessions appeared around suspicious requests? |
| Discovery / movement | Operators read `psappsrv.cfg` and `config.xml`, mapped hosts, and used a fanout script with SSH credential spraying. [2] | Which credentials, hosts, mounts, WebLogic domains, and schedulers were reachable? |
| Collection / impact | Data was compressed with zstd, an extortion marker was propagated, and stolen material was published for some organizations. [2] | Which data was read, staged, transferred, deleted, changed, or publicly disclosed? |
| Category | Concrete topic-specific values | Use / boundary |
|---|---|---|
| Attacker IP addresses | 142.11.200.186, 142.11.200.187, 142.11.200.188, 142.11.200.189, 142.11.200.190; related leak-site mirror 176.120.22.24. [2] | Time-bound staging and infrastructure pivots; enrichment and correlation required. |
| Domains / FQDNs | azurenetfiles.net. [2] | Masqueraded as Azure-related infrastructure; do not block legitimate Microsoft domains by resemblance. |
| Attacker-controlled or malicious URLs | wss://azurenetfiles.net:443/agent.ashx. Additional issue-specific malicious HTTP download URLs are not public. [2] | WebSocket C2 pivot; endpoint paths below are product observables, not attacker-owned URLs. |
| Filenames | meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, meshagent64-v2.exe, meshagent, .bash_history, [victim_abbreviation]_fanout.sh, and README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT. [2] | Names can be changed or benign in isolation; validate path, signer, hash, parent, and timing. |
| File hashes (SHA-256) | 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35; f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc; d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f; c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f; 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309. [2] | Respectively command history and four staged MeshCentral agents; exact matching is high confidence but not exhaustive. |
| Network observables | Python SimpleHTTP on TCP 8888; outbound WebSocket TLS to the C2; outbound SMB TCP 445 from PeopleSoft to untrusted hosts; outbound SSH; zstd-associated transfer staging. [2] | Correlate source, destination, process, user, bytes, and time. |
| HTTP observables | POST /PSEMHUB/hub; POST /PSIGW/HttpListeningConnector; loopback values 127.0.0.1, localhost, or ::1, or internal ranges in request data. [2] | External origin and anomalous values matter; route presence alone is not exploitation. |
| Product observables | Unexpected JSPs under .../PSEMHUB.war/; content in envmetadata/transactions/; unexpected logs, persistantstorage, or scratchpad; recently changed XML in envmetadata/data/environment/. [2] | Compare with a known-good release manifest and preserve metadata. |
| Identity observables | SSH password spraying and key-based attempts; service-account execution; unexpected use of PeopleSoft, WebLogic, storage, or administrative credentials. [2][6] | Review successes and failures, source hosts, privilege changes, and post-reset sessions. |
| Host observables | `meshctrl.js RunCommand`, `sshpass`, victim-specific `/tmp/*_fanout.sh`, marker propagation, `zstd` archive creation, inspection of `psappsrv.cfg` and `config.xml`, and new or modified JSP/XML. [2] | Sequence and parent-child context distinguish administration from intrusion. |
| Layer | Hunt logic | Preserve |
|---|---|---|
| PIA / proxy | External POSTs to `/PSEMHUB/hub` or `/PSIGW/HttpListeningConnector`; loopback/internal values; unusual bodies, status codes, bytes, and user agents. | Raw access logs, proxy/WAF logs, headers, bodies where lawfully retained, TLS/proxy mapping, and clock sources. |
| Web tier | Unexpected JSPs in PSEMHUB.war, transactions content, suspicious directories, changed XMLDecoder material, and known hashes. | Full paths, hashes, timestamps, ownership, permissions, package manifests, volatile state, and copies. |
| Host / EDR | Java/WebLogic child processes, MeshCentral agents, node `meshctrl.js`, sshpass, zstd, shell fanout, archive and marker creation. | Process trees, command lines, environment, network sockets, memory, scheduled services, and persistence. |
| Network | Connections to published IPs/domain, TCP 8888, outbound 445, WebSocket C2, SSH fanout, and unusual bulk egress. | DNS, firewall, proxy, NetFlow, packet capture where available, NAT, VPN, and load-balancer records. |
| Identity / data | Credential spray, service-account anomalies, storage access, database queries/exports, changed integration secrets, and unexplained privileged sessions. | Authentication, PAM, database audit, storage, scheduler, integration, and downstream provider logs. |
Search at least from 27 May through remediation and expand earlier or later when correlated evidence requires it. No-hit results must record telemetry coverage and retention gaps.
| Phase | Action | Exit evidence |
|---|---|---|
| 0–4 hours | Assign incident lead; preserve volatile and durable evidence; restrict external PSEMHUB/Integration Broker access; isolate suspicious tiers without destroying evidence. | Asset list, clock-normalized collection, containment record, and business continuity decision. |
| 4–24 hours | Apply the correct Oracle mitigation on clean systems; hunt IOCs and behaviors; scope identities, databases, storage, integrations, schedulers, and connected hosts. | MOS patch proof, exposure window, findings matrix, credential and data scope, and owner for each gap. |
| 1–3 days | Revoke or rotate exposed trust, contain lateral paths, validate data integrity, notify providers and counsel, and rebuild from trusted state where integrity is uncertain. | Rotation completion, clean validation, impact assessment, recovery authorization, and notice decision. |
| Recovery | Restore in stages with least privilege, restricted administrative reachability, enhanced monitoring, and documented rollback. | Known-good image/configuration, functional tests, monitored change window, and accountable risk acceptance. |
| Post-incident | Reconcile exposure, compromise, acquisition, publication, and extortion evidence; retain lessons and monitor source changes. | Final evidence index, source-qualified narrative, control improvements, and open uncertainty register. |
| Owner | Action now | Closure proof |
|---|---|---|
| CIO / CISO | Declare overdue remediation and compromise-assessment work for historically reachable instances. | Signed inventory, owner, priority, service decision, findings, and residual-risk acceptance. |
| PeopleSoft owner | Apply the branch-specific MOS patch; disable/remove EMHub where appropriate; restrict exposed endpoints. | MOS patch ID and logs, restart, route tests, known-good manifest, and application validation. |
| SOC / DFIR | Run time-bounded IOC and behavior hunts across web, host, network, identity, database, and storage telemetry. | Queries, time ranges, data sources, retention gaps, results, triage, and escalation decisions. |
| IAM / infrastructure | Rotate or revoke plausibly exposed service accounts, SSH material, keys, tokens, and integration trust. | Credential inventory, rotation timestamps, dependent-system updates, and old-session invalidation. |
| Legal / privacy / insurer | Preserve privilege and notification options; contact appropriate carriers and providers using verified facts. | Notice log, coverage record, data-scope rationale, law-enforcement decision, and approved communications. |
| Lens | Specific risk | Decision question |
|---|---|---|
| SMB | PeopleSoft exposure may be inherited through payroll, benefits, education, insurance, government, or parent-company services even when the SMB runs no instance. | Which provider holds our data, which instance served it, was that instance reachable, patched, investigated, and was our data accessed? |
| MSP / hosting | Shared administration, identity, network, storage, and evidence retention can create cross-tenant operational and notification obligations. | Can we prove per-tenant exposure, patch ID, endpoint state, hunt coverage, data scope, and separation? |
| Cyber insurance | Coverage, consent, panel-provider, preservation, and notice duties may attach before impact is fully known. | Were the carrier and counsel notified on time, and are costs and decisions tied to verified exposure and impact? |
| Underwriting / control proof | A current base release label or WAF rule is not durable remediation evidence. | Is there exact MOS patch proof, restricted administrative exposure, tested logging, credential hygiene, and recoverable architecture? |
| Loss boundary | Campaign capability, exposure notifications, and leak-site claims can be confused with customer-specific loss. | What is proven for this entity: exposure, attempt, access, acquisition, publication, extortion, disruption, or restoration cost? |
| Date | Event | Decision meaning |
|---|---|---|
| 27 May 2026 | Earliest observed campaign activity; MeshCentral and certificate tooling prepared. [2] | Start of the public observed window, not proof no earlier activity occurred. |
| 29 May | Staging history records an authenticode-related npm check. [2] | Investigation lead, not proof that payloads were signed. |
| 9 Jun | Open staging directories enabled triage; campaign correlated with leak-site publication. [2] | Concrete tooling and impact evidence became available. |
| 10 Jun | Oracle released Security Alert revision 1 and patch path. [1] | Disclosure and vendor remediation point; prior activity is zero-day use. |
| 11 Jun | Mandiant/GTIG published attribution, IOCs, behaviors, impacts, and hardening. [2] | Campaign-specific detection became public. |
| 12 Jun | CISA added KEV with known ransomware use. [3][4] | Authoritative exploitation and federal action status. |
| 15 Jun | CISA due date. [3] | Past-due systems remain priority work and may require forensic triage. |
| 16 Jun | Oracle June CSPU incorporated the alert patch and additional fixes. [10] | Follow current Oracle customer patch documentation. |
| 23 Jul | NVD last-modified date at research cutoff. [4] | No newer public CNA version boundary was identified. |
| 9 Aug | CVE Watch v1 research cutoff. | Continue daily material-change monitoring. |
| Claim | Public status | Evidence boundary |
|---|---|---|
| UNC6240 / ShinyHunters | Mandiant/GTIG attributes the active compromise and extortion campaign. [2] | Campaign-level source assessment; do not infer local actor from a single indicator. |
| More than 100 organizations | GTIG notified IP owners correlated with potentially vulnerable endpoints; 68% were higher education. [2] | Exposure-notification population, not confirmed victims or total global scope. |
| Confirmed campaign victims | GTIG says some organizations were compromised and had stolen data published. [2] | The report does not enumerate a complete victim list or quantify every dataset. |
| Ransomware / extortion | CISA marks known ransomware use; GTIG documents data theft, extortion markers, and leak-site publication. [2][3] | No retained source establishes encryption as an observed outcome. |
| This organization | Unknown until local investigation. | Affected version, IOC match, or sector overlap alone cannot establish access, data theft, or attribution. |
| Question | Decision answer |
|---|---|
| What exact version fixes it? | Oracle publicly identifies affected supported branches 8.61 and 8.62 but does not publish a fixed patch-level number. Use the exact branch-specific MOS patch referenced by the alert and retain installation proof. [1][10] |
| Can we mitigate before patching? | GTIG recommends disabling EMHub in multi-server configurations or removing PSEMHUB in single-server configurations; otherwise block external PSEMHUB and Integration Broker access. WAF body inspection alone is insufficient. [2] |
| Does patching close the incident? | No. Confirmed zero-day exploitation means historically reachable systems need forensic triage and trust restoration. [2][3][8] |
| Does one IOC match prove ShinyHunters? | No. Validate time, asset role, process, path, prevalence, and corroborating behavior; preserve attribution as source-owned until evidence supports it. |
| Do no IOC hits mean we are clean? | No. Infrastructure, names, and hashes can change, and retention may be incomplete. Behavior, product evidence, and telemetry coverage control confidence. |
| Is there a public exploit? | No retained primary source establishes a complete public PoC. Exploitation and KEV status already establish urgency. |
| Source organization | What it contributes | Evidence boundary |
|---|---|---|
| Oracle | Vendor scope, affected supported branches, unauthenticated HTTP precondition, CVSS, impact, and patch path. | Does not publish public fixed patch-level numbers, campaign IOCs, victims, or attribution. |
| Mandiant / GTIG | Observed window, UNC6240 attribution, notifications, outcomes, infrastructure, hashes, files, commands, detection, and hardening. | Visibility is campaign-specific; notification figures are not a victim census. |
| CISA | KEV addition, due date, required action, BOD 26-04 reference, and known-ransomware-use field. | Does not prove local compromise, victim identity, encryption, or loss. |
| NVD / CVE Program | Canonical/CNA record, CVSS provenance, affected configurations, CWE, SSVC, and change history. | NVD has no independent local incident telemetry or fixed build boundary. |
| TrendAI ZDI | HubMBeanPersistance and deserialization technical detail from credited researchers. | Separate score and framing do not supersede Oracle's CNA record or prove campaign behavior. |
| MITRE CWE | Definition of CWE-306 for weakness interpretation. | Taxonomy is not exploit, campaign, or victim evidence. |
| Product | Connection | Open |
|---|---|---|
| ShinyHunters Oracle PeopleSoft Exploitation Campaign | 32-card campaign-response companion covering actors, victim boundaries, enterprise-app trust, exact IOCs, and operational playbooks. | Open Flash Threat Brief |
| CVE / KEV Cards | Search the canonical vulnerability record and lifecycle fields. | Open CVE Cards |
| Threat Actor Cards | Review source-bounded ShinyHunters and UNC6240 actor relationships without collapsing aliases. | Open Actor Cards |
Create an account and sign-in to use this card.
Record your personal notes and comments in this card related to this brief.
Fact boundary: Source facts are cited to the organization that controls them. Defensive prioritization, SMB dependency analysis, and local response sequencing are IntelliOS assessments.
Patch boundary: Public Oracle pages do not expose exact fixed patch-level numbers. The exact customer fix must be proven with the applicable MOS patch record.
IOC boundary: Published infrastructure and hashes are campaign-specific and point-in-time. Absence does not exclude exploitation; presence requires context.
Safety: Preserve evidence before destructive cleanup when feasible, coordinate application and database owners, protect employee and student privacy, and conduct only authorized validation.
[1] Oracle — Security Alert Advisory — CVE-2026-35273
Tier 0 · 10 Jun 2026 · Controlling vendor source for affected supported releases, component, protocol, unauthenticated reachability, CVSS, impact, and official patch path.
https://www.oracle.com/security-alerts/alert-cve-2026-35273.html[2] Mandiant / Google Threat Intelligence Group — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Tier 0 · 11 Jun 2026 · Controlling campaign source for exploitation window, attribution, victims-at-risk boundary, IOCs, observed tradecraft, impacts, detection, and hardening.
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/[3] CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-35273
Tier 0 · Added 12 Jun 2026 · Controls KEV status, due date, required action, and known-ransomware-use value.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273[4] NIST NVD — CVE-2026-35273
Tier 0 · Published 11 Jun; modified 23 Jul 2026 · Corroborates the CNA record, CVSS provenance, affected CPEs, CWE-306, SSVC, and KEV history.
https://nvd.nist.gov/vuln/detail/CVE-2026-35273[5] CVE Program / Oracle CNA — Canonical CVE-2026-35273 record
Tier 0 · Checked 9 Aug 2026 · Canonical identifier and CNA-supplied product and severity record.
https://www.cve.org/CVERecord?id=CVE-2026-35273[6] TrendAI Zero Day Initiative — ZDI-26-388 — HubMBeanPersistance Deserialization RCE
Tier 1 · 24 Jun 2026 · Technical detail from researchers credited by Oracle; does not control campaign attribution or victim impact.
https://www.zerodayinitiative.com/advisories/ZDI-26-388/[7] MITRE CWE — CWE-306 — Missing Authentication for Critical Function
Tier 1 · Checked 9 Aug 2026 · Defines the CISA-ADP weakness classification and its interpretation boundary.
https://cwe.mitre.org/data/definitions/306.html[8] CISA — BOD 26-04 Implementation Guidance
Tier 0 · 2026 · Controls federal forensic-triage and risk-prioritization context referenced by the KEV action.
https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk[9] Oracle — PeopleTools 8.62 Change Assistant and Update Manager
Tier 1 · 2025 documentation · Vendor architecture context for Environment Management Hub; not vulnerability or campaign evidence.
https://docs.oracle.com/cd/G41076_01/psft/pdf/pt862tswu-b112025.pdf[10] Oracle — Critical Security Patch Update — June 2026
Tier 1 · 16 Jun 2026 · Confirms that the June PeopleTools security update incorporates the alert patch and additional fixes.
https://www.oracle.com/security-alerts/cspujun2026.html| Version | Date | Material change | Basis |
|---|---|---|---|
| v1 | 9 Aug 2026 | Initial continuing CVE Watch publication. Reconciled Oracle product scope and public patch boundary, confirmed zero-day campaign and CISA KEV status, exact IOCs and behavioral observables, detection and response, SMB/MSP/insurance decisions, victim and attribution limits, source weighting, citations, and continuing-watch rules. | [1][2][3][4][5][6][7][8][9][10] |
Monitoring rule: issue a new version only for a material primary-source change such as revised Oracle fixed-state guidance, new campaign IOCs or detection, changed KEV/ransomware status, authoritative victim/impact reporting, attribution change, or public-exploit confirmation. No-change checks do not create versions.
