ShinyHunters may oyidan beri ekspluatatsiya qilgan Oracle PeopleSoft'dagi muhim xato bitta kamchilik emas, balki uchta zanjirlangan kamchilik ekanligini, uni xabar qilgan tadqiqotchilar bu hafta aytishdi.
Oracle iyun oyida uchalasini ham bitta identifikator — CVE-2026-35273 ostida tuzatdi. Uning ildizi — server tomonidagi so'rov soxtalashtirish (SSRF) bo'lib, u ichki boshqaruv interfeysiga yetib boradi, chunki PeopleSoft o'zining loopback manziliga sukut bo'yicha ishonadi, bu esa tizimga kirishsiz masofadan kod bajarish imkoniyatini ochadi.
Bu tahlil Zero Day Initiative (ZDI) dan Bobby Gould tomonidan keltirilgan, uning jamoasi xatoni Oracle'ga xabar qilgan.
O'z tahlilida ZDI ikki PeopleSoft komponenti bo'yicha uchta alohida zaiflikni xabar qilganini va har biriga alohida CVE tayinlash uchun Oracle bilan ishlayotganini aytdi. Bu hafta holatiga ko'ra, iyun oyidagi bitta identifikator hali ham yagona qayd etilgan.
CVE-2026-35273 PeopleSoft Enterprise PeopleTools 8.61 va 8.62 versiyalariga ta'sir qiladi, CVSS bahosi 9.8 ga teng va autentifikatsiyasiz hujumchiga tarmoq orqali serverni egallab olish imkonini beradi. Oracle tuzatishni 10-iyundagi navbatdan tashqari xavfsizlik ogohlantirishida e'lon qildi. Bu kamchilik CISA'ning Ma'lum Ekspluatatsiya Qilingan Zaifliklar katalogida.
Hujumchilar bu tuzatish joylashtirilishidan oldin ham undan foydalanishgan. Mandiant va Google Threat Intelligence Group (GTIG) bu kampaniyani UNC6240 deb kuzatadigan guruhga — yaxshiroq ShinyHunters nomi bilan tanilgan — bog'laydi, u 27-maydan 9-iyungacha, asosan universitetlarga qarshi, bu kamchilikdan foydalangan. Bu faoliyat Oracle'ning 10-iyundagi ogohlantirishidan oldin sodir bo'lgani uchun, u butun vaqt davomida zero-day bo'lgan.
Sentyabr oyidagi keyingi hisobotda Mandiant ta'lim sohasidan tashqari texnologiya, IT xizmatlari, sog'liqni saqlash, qishloq xo'jaligi, transport va davlat sohalariga tarqalgan, dunyo bo'ylab o'nlab tizimlarga ta'sir qilgan yangilangan, kengroq to'lqinni xabar qildi.
ZDI tahlili bu yagona tuzatish aslida nimani yopganini tushuntiradi. Ikki PeopleSoft komponenti ishtirok etadi, ikkalasi ham alohida veb-ilovalar sifatida ishlaydi. Integration Gateway (PSIGW) tashqi tizimlar bilan xabar almashadi. Environment Management Hub (PSEMHUB) — faqat ishonchli xostlarga javob berishi kerak bo'lgan ichki admin interfeysi.
Birinchi kamchilik — PSIGW'dagi SSRF. Hujumchi uning tinglovchi ulanishiga so'rov yuboradi va u yo'naltiradigan manzilni ham, yuboradigan to'liq yukni ham nazorat qiladi, deb aytdi ZDI; ishlov beruvchi manzil qonuniy maqsad ekanligini tekshirmaydi. Bu o'zi cheklangan bo'lar edi, lekin u yetib borishi mumkin bo'lgan narsalar tufayli emas.
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.
Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution without a login.
The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle.
In its analysis, ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each. As of this week, the one June identifier is still the only one on the record.
CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over the server over the network. Oracle released its fix in an out-of-band security alert on June 10. The flaw is on CISA's Known Exploited Vulnerabilities catalog.
Attackers were already using it before that fix was in place. Mandiant and Google Threat Intelligence Group (GTIG) attribute a campaign to the group it tracks as UNC6240, better known as ShinyHunters, that exploited the flaw between May 27 and June 9, mostly against universities. Because that activity came before Oracle's June 10 advisory, it was a zero-day the whole time.
In a September follow-up, Mandiant reported a renewed, larger wave that spread beyond education to technology, IT services, healthcare, agriculture, transport, and government, affecting dozens of systems worldwide.
ZDI's analysis explains what that single patch actually closed. Two PeopleSoft components are involved, both run as separate web applications. The Integration Gateway (PSIGW) exchanges messages with outside systems. The Environment Management Hub (PSEMHUB) is an internal admin interface that is supposed to answer only to trusted hosts.
The first flaw is the SSRF in PSIGW. An attacker sends a request to its listening connector and controls both the address it forwards to and the full payload it sends, ZDI said; the handler does no check that the destination is a legitimate target. That alone would be limited, except for what it can reach.