CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better
Oracle's[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.- Start
- Jun 10, 202690% CONFIDENCEsource
Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters
Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.
- On 10 June 2026 Oracle issued Security Alert CVE-2026-35273 for PeopleSoft Enterprise PeopleTools 8.61 and 8.62, a flaw in the Updates Environment Management component that is remotely exploitable without authentication and may allow remote code execution, rated 9.8 on CVSS 3.1[1].
- Oracle released mitigations and urged "immediate action"; PeopleSoft Enterprise Applications customers may also be affected, and researchers from TrendAI's Zero Day Initiative are credited[1][3].
- The same day ShinyHunters confirmed to BleepingComputer that it had stolen data from 300 PeopleSoft instances at more than 100 organizations, mostly in education, and the University of Nottingham acknowledged a cybersecurity incident[4].
- Mandiant said it notified over 100 organizations, most in the United States and 68 percent in higher education, and linked the exfiltration to a server tied to ShinyHunters' leak site[3].
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on 12 June with a 15 June deadline for federal agencies[2].