PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data

A significant vulnerability in Oracle's PeopleSoft software has been actively exploited by one of the world's most notorious ransomware groups, known as ShinyHunters. This group has reportedly targeted around 100 organizations, successfully extorting at least one victim by threatening to release stolen data. The vulnerability, identified as CVE-2026-35273, has a critical severity rating of 9.8 out of 10, marking it as one of the most severe zero-day vulnerabilities detected this year. According to researchers from Google’s Mandiant security team, the flaw is classified as a server-side request forgery (SSRF), which allows attackers to send requests from a vulnerable server to other systems within the targeted organization. Oracle has acknowledged the issue, stating that the SSRF vulnerability is remotely exploitable and has issued a temporary mitigation solution. However, a complete patch for the flaw has not yet been rolled out. Meanwhile, Mandiant has confirmed that victims of the attacks are facing extortion demands from the group. Among the affected entities, the University of Nottingham recently confirmed that it had fallen victim to the breach, resulting in a “significant” amount of student data being compromised. This announcement followed ShinyHunters' claim that the university was among its latest targets, as they released gigabytes of data purportedly obtained from the hack. Since May 27, ShinyHunters has been exploiting this vulnerability, and as of mid-week, they had targeted approximately 300 endpoints across 100 organizations, with around 68% of these belonging to the higher education sector. Researchers have noted that the group has exposed several directories that indicate ongoing attacks on PeopleSoft, and they have even left a staging server accessible, containing tools used during the attack.