How One Oracle Bug Became a Three-Part Attack

A critical Oracle PeopleSoft vulnerability exploited by hackers was not one bug, but a chain of three separate flaws, researchers have revealed.

A critical vulnerability in Oracle PeopleSoft, actively exploited by the ShinyHunters group, has been revealed to be a chain of three distinct flaws. The Hacker News reports that researchers who discovered the issue detailed the complex attack method this week. Oracle addressed all three vulnerabilities under a single identifier, CVE-2026-35273, in its June patch release. The exploit has been in use by attackers since at least May, making this a zero-day vulnerability that was leveraged before a fix was available. This new information provides crucial context for security teams who have already applied the patch and those investigating potential compromises within their enterprise systems. The use of a single CVE for a multi-stage attack highlights a common challenge in vulnerability management, where the initial severity score may not fully capture the true risk of a chained exploit. This revelation changes the understanding of the threat from a single point of failure to a more sophisticated, multi-step intrusion that requires a deeper level of forensic analysis to detect and remediate.

The root of the exploit chain is a server-side request forgery (SSRF) vulnerability. According to the researchers, the PeopleSoft application was designed to implicitly trust requests originating from its own loopback address, which is the server's internal 'localhost' identity. This misplaced trust is the entry point for the entire attack. An attacker can craft a request that tricks the server into making a secondary request on their behalf to an internal-only management interface. This interface, which should never be exposed to the outside world, becomes accessible through the SSRF flaw. Once the attacker gains access to this internal endpoint, they can then trigger the second and third vulnerabilities in the chain to achieve their ultimate goal, which could range from information disclosure to remote code execution. This technique of chaining vulnerabilities is a hallmark of advanced threat actors, who methodically probe systems for seemingly minor weaknesses that can be combined to bypass security controls and achieve a much greater impact than any single flaw would allow on its own.

This incident is a classic example of a growing trend where attackers focus on complex enterprise applications that are the backbone of many large organizations. Systems like Oracle PeopleSoft manage critical business functions, including human resources, payroll, and finance, making them high-value targets for data theft and corporate espionage. The involvement of ShinyHunters, a notorious threat actor known for large-scale data breaches and selling stolen information on the dark web, confirms the severity and financial motivation behind such attacks. Furthermore, the use of an SSRF as the initial vector is increasingly common. As security defenses have improved at stopping direct external attacks, attackers are finding clever ways to make the server attack itself from the inside. This incident serves as a powerful case study on the dangers of implicit trust within application architecture and the need for a zero-trust mindset, even for internal network traffic. It also reflects a broader pattern where a single CVE identifier can obscure a more complex reality, potentially causing teams to underestimate the patch's importance or the nature of the threat.

For IT and security teams, the immediate priority is to ensure that the June patch from Oracle, which addresses CVE-2026-35273, has been deployed across all PeopleSoft instances. However, the work does not stop at patching. Given that this vulnerability was actively exploited as a zero-day, organizations should conduct a thorough threat hunt. This involves reviewing server logs for any signs of SSRF activity or unauthorized access to internal management interfaces, especially during the period before the patch was applied. Looking ahead, this should prompt a wider security review of enterprise applications. Developers and architects must scrutinize any component that trusts local or internal requests, as these are prime targets for SSRF. The key lesson is that security is not just about patching individual bugs but understanding how they can be chained together. Expect to see threat actors continue to develop these multi-stage exploits, forcing defenders to think less about single vulnerabilities and more about holistic attack paths and the systemic weaknesses that enable them.

This vulnerability chain demonstrates how attackers can combine lower-severity flaws into a critical-level exploit. For security teams, it's a reminder that a single CVE can mask a complex attack path, and that internal services trusting loopback addresses create significant server-side request forgery (SSRF) risks.

The active exploitation of Oracle PeopleSoft, a system managing sensitive HR and financial data, poses a severe risk of data breaches for enterprises. This incident underscores the high cost of delayed patching and the operational disruption caused by sophisticated attacks on core business software.