PeopleSoft 0-day affecting organizations steals gigabytes of data
2 days ago
- #higher-education
- #ransomware
- #zero-day
- ShinyHunters exploited a critical SSRF vulnerability (CVE-2026-35273) in Oracle PeopleSoft for over two weeks before Oracle flagged it.
- The vulnerability has a severity rating of 9.8/10 and was used to target around 100 customers, extorting at least one.
- About 68% of affected organizations are in the higher education sector, with the University of Nottingham confirmed as a victim.
- Oracle issued a stopgap mitigation but has not fully patched the flaw; Google Mandiant confirmed victims received extortion demands.
- Attackers exposed directories and left a staging server with tools, indicating ongoing targeting of PeopleSoft systems.