Attackers Exploit Oracle PeopleSoft Flaw to Deploy Web Shells
A critical zero-day vulnerability in Oracle PeopleSoft, tracked as CVE-2026-35273, is being actively exploited by attackers to deploy web shells and bypass web application firewalls.
Why it matters
This vulnerability allows unauthenticated remote code execution, increasing the risk of unauthorized access and persistent compromise across multiple sectors worldwide.
SOC impact
Monitor web application logs and network telemetry for indicators of web shell deployment and suspicious traffic patterns that may bypass existing WAF protections. Confirm the presence of affected PeopleSoft instances and investigate unusual access activity for signs of exploitation.
Recommended actions
- Identify assets running Oracle PeopleSoft within the environment
- Review web server and application logs for web shell indicators
- Monitor for traffic that bypasses web application firewalls
- Investigate authentication and access anomalies related to PeopleSoft
- Consult The Hacker News report for detailed threat context
Executive Summary
Google has issued a warning about a widespread exploitation campaign targeting CVE-2026-35273, a critical zero-day vulnerability in Oracle PeopleSoft. The flaw enables unauthenticated remote code execution, allowing attackers—linked to the ShinyHunters group—to bypass web application firewalls and deploy web shells. This campaign is impacting multiple sectors globally, posing an increased risk of unauthorized system access. Security teams must prioritize identifying affected assets and enhancing monitoring to detect potential exploitation attempts.
SOC Impact
Monitor web application logs and network telemetry for indicators of web shell deployment and suspicious traffic patterns that may bypass existing WAF protections. Confirm the presence of affected PeopleSoft instances and investigate unusual access activity for signs of exploitation.
What SOC Teams Should Validate
- Identify assets running Oracle PeopleSoft within the environment
- Review web server and application logs for web shell indicators
- Monitor for traffic that bypasses web application firewalls
- Investigate authentication and access anomalies related to PeopleSoft
- Consult The Hacker News report for detailed threat context
Why It Matters
This vulnerability allows unauthenticated remote code execution, increasing the risk of unauthorized access and persistent compromise across multiple sectors worldwide.