CVE-2026-35273: SSRF to RCE chain in Oracle PeopleSoft

What happened and what to do

The post by Zero Day Initiative, part of TrendAI, describes three distinct vulnerabilities in Oracle PeopleSoft components, reported to Oracle on June 10, 2026 and fixed under a single CVE, while separate CVE assignments are being coordinated. The first is a server-side request forgery (SSRF) in the PeopleSoft Integration Gateway (PSIGW), identified as ZDI-CAN-31816. Through the HttpListeningConnector, an attacker controls the target and the full request payload, which allows reaching the loopback interface and satisfying the validateClient check of the PeopleSoft Environment Management Hub (PSEMHUB), which is meant to protect administrative functions. On September 25, 2026, Mandiant published a report on ongoing mass exploitation of CVE-2026-35273 by the ShinyHunters group.

In practice, a company running PeopleSoft should treat this exposure as a priority. A response plan can start by applying Oracle's fix and checking which instances expose PSIGW and PSEMHUB to untrusted networks. Next, restrict listening connectors to known sources, block server-initiated requests to internal or loopback addresses, and do not rely on validateClient alone as a barrier. A monitoring pipeline that logs and alerts on POST requests to the HttpListeningConnector endpoint with internal targets or anomalous payloads, feeding a dashboard of affected environments, is also useful.

How the consultancy can help

A diagnosis of how exposed your PeopleSoft instances are to this SSRF and RCE chain, including an inventory of reachable PSIGW and PSEMHUB endpoints, a review of outbound traffic from the application server, and an assessment of applied fixes. Then a scoped implementation of network restrictions, monitoring of suspicious requests and alerts, operated in the client's environment.

Next step

If your company uses Oracle PeopleSoft, send a short description of your environment, the versions in use, and where the PSIGW and PSEMHUB components are exposed. Wendelmaques will then prepare a diagnosis and a scoped proposal.