Researchers have reported that a critical Oracle PeopleSoft vulnerability exploited by ShinyHunters since May was actually made up of three chained weaknesses rather than one isolated bug. Oracle patched the issues in June under a single identifier, CVE-2026-35273. According to the report, the chain starts with a server-side request forgery (SSRF) issue that can reach an internal management interface because PeopleSoft trusts requests coming from its own loopback address.
What happened
The new detail is important because it changes how security teams should understand the risk. Instead of a standalone software defect, the issue appears to involve multiple weaknesses that can be combined to bypass assumptions built into the application architecture. In this case, researchers said the root cause involved SSRF access to an internal interface that should normally be shielded from external access.
Oracle had already released patches in June, grouping the three flaws under one CVE. The source report links the vulnerability chain to exploitation by ShinyHunters, a threat actor known for targeting organisations and data-rich systems.
Why it matters for European businesses
For European businesses, the main issue is not only the existence of a PeopleSoft vulnerability, but the type of weakness involved. SSRF flaws are especially relevant in modern enterprise environments because they can let attackers pivot from internet-facing systems to internal services that were assumed to be inaccessible from outside.
That matters for businesses running HR, finance, payroll, procurement or other back-office systems on PeopleSoft. If an internal management interface can be reached through a trusted local path, organisations may need to reassess whether network boundaries and application trust assumptions are strong enough.
The report is also a reminder that a single CVE may hide a more complex exploitation path. For IT and security teams, that can affect patch prioritisation, exposure reviews and incident response. Where exploitation is linked to a known threat actor, delay in patching can increase business risk, especially for systems containing employee records, financial data or operational information.
Who may be affected
- Organisations using Oracle PeopleSoft for HR, payroll, finance, procurement or administration
- Large SMEs and mid-market firms that still rely on legacy enterprise software in hybrid environments
- IT and security teams responsible for patching, access controls and internal application security
- Regulated organisations handling sensitive employee, customer or financial data
- Service providers and digital partners involved in enterprise application hosting or infrastructure management
What companies should consider
- Confirm patch status immediately for Oracle PeopleSoft environments and verify whether updates released in June for CVE-2026-35273 have been applied.
- Review internet exposure of PeopleSoft components and check whether any internal management interfaces could be reached indirectly through application behaviour.
- Assess logging and monitoring for unusual requests that may indicate SSRF-style probing or access to internal-only endpoints.
- Revisit trust assumptions around loopback, localhost and internal service communications, especially in older enterprise applications.
- Prepare incident response checks if patching was delayed, including review of authentication logs, admin actions and access to sensitive records.
- Coordinate with hosting or managed service partners where PeopleSoft is operated by third parties, so remediation and verification are documented.
Based on the information available, businesses should treat this as a practical patching and exposure-management issue rather than a theoretical software bug. For organisations still operating PeopleSoft, the combination of reported active exploitation and a chained vulnerability path raises the priority of verification and review.