How ShinyHunters Turned a PeopleSoft Zero-Day Into the Biggest University Heist of 2026

The Vulnerability: CVE-2026-35273

Here's the thing about zero-days: they don't care how big your budget is. CVE-2026-35273 lives in Oracle PeopleSoft Enterprise PeopleTools — specifically versions 8.61 and 8.62 — and it carries a CVSS base score of 9.8, which is about as bad as it gets. Unauthenticated remote code execution means you don't even need a username or password to walk right in the front door. No social engineering. No phishing email with a suspicious attachment. Just an open port and a willing attacker.

Oracle's advisory is refreshingly blunt: "This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution." They've released emergency mitigations while a full patch sits in the pipeline. That gap — between the moment the exploit hits the wild and the moment you can actually patch it — is where organizations get burned. ShinyHunters didn't wait for the patch. They moved fast, and they moved hard.

What makes this particularly nasty is that PeopleSoft isn't some obscure internal tool. It's the backbone of student information systems at thousands of universities, K-12 districts, and government agencies. When you compromise PeopleSoft, you're not just getting access to a database — you're sitting on social security numbers, financial aid records, research data, and personnel files for hundreds of thousands of people. For a detailed technical breakdown of this vulnerability's mechanics, see our analysis: Critical Exploited Zero-Day Found in Oracle PeopleSoft Applications.

Attack Infrastructure and Technical Indicators

Cybersecurity researcher Michael R turned up exposed online directories containing attack-related tooling, and the IP addresses he surfaced paint a picture of a well-organized operation. The campaign leaned on a cluster of IPs in the 142.11.200.x range — specifically .186 through .190 — plus 108.174.202.99 as a secondary node, and 176.120.22.24, which is the public ShinyHunters data leak site.

Mandiant's analysis revealed something particularly clever in the operational security: threat actors used exposed staging servers to host HTTP services and deployed custom MeshCentral remote management agents. Here's where it gets sneaky — these agents communicated with attacker-controlled infrastructure that was masquerading as Microsoft Azure services. If you're a sysadmin glancing at network logs, that traffic looks like it's going to legitimate Azure. It blends right in with normal cloud operations. That kind of disguise makes initial detection significantly harder, and it tells you this group has invested real time in understanding how enterprise networks actually look.

The staging servers weren't just passive drop points either. They hosted active HTTP services that served as intermediaries in the attack chain, giving the operators a layer of separation between their actual command-and-control infrastructure and the compromised PeopleSoft instances. It's the kind of operational discipline you'd expect from a state-sponsored actor, not a typical extortion gang.

Mandiant's Technical Analysis

Mandiant didn't just confirm the exploitation — they mapped out the full kill chain, and it's a textbook example of how modern threat actors operate against enterprise applications.

Reconnaissance came first. Attackers didn't just blast in and start grabbing data. They mapped PeopleSoft configurations, cataloged WebLogic setups, and understood the topology of each target before touching anything valuable. This isn't script-kiddie behavior. This is methodical, patient work.

Lateral movement followed. Once inside, the attackers used scripts to move across internal systems, leveraging stolen or hardcoded credentials they'd picked up along the way. PeopleSoft deployments often share authentication mechanisms across modules, and once you're in one piece of the puzzle, the rest tends to fall open.

Data exfiltration sealed the deal. Compressed exfiltrated data got shipped to 176.120.22.24 — the ShinyHunters leak site. That connection alone is enough to definitively link this activity to the extortion group, regardless of any other indicators.

Mandiant identified two specific endpoints that proved to be the primary attack vectors:

• /PSEMHUB/ — PeopleSoft Enterprise Message Hub, which handles inter-system messaging
• /PSIGW/HttpListeningConnector — the Integration Gateway's HTTP listener, designed to accept external web service calls

Both of these are meant to be accessible — that's kind of their job — but when they're exposed without proper authentication hardening, they become open windows. Mandiant's IOC guidance is worth memorizing: unexpected .jsp webshell files in WebLogic application directories, unauthorized binaries staged in PSEMHUB transaction folders, suspicious directories like logs, persistantstorage, or scratchpad that shouldn't exist, and recently modified XML files that could maintain persistence or trigger remote code execution after a system restart. If you see any of these, assume compromise and escalate immediately.

Scope of the Campaign

The numbers here are staggering, and they tell you everything you need to know about why this matters beyond the higher education bubble.

300+ PeopleSoft instances compromised. That's not a handful of test environments or legacy systems gathering dust. These are production installations handling real data for real people.

100+ organizations affected. Mandiant initiated notifications to over 100 global organizations whose IP addresses correlated with potentially vulnerable endpoints upon detecting active scanning and exploitation. The scope kept expanding as Mandiant looked deeper.

68% of targets were in higher education. The rest? Mostly US-based institutions across other sectors. Universities are sitting on some of the most valuable data profiles in existence — students, faculty, researchers, alumni. And let's be honest: university IT departments are often understaffed and underfunded relative to the attack surface they manage. They're running critical infrastructure on budgets that would make a Fortune 500 CISO blush.

ShinyHunters has been targeting the education sector aggressively. They recently hit Instructure Canvas in a massive cyberattack that exposed 280 million data records for students, teachers, and staff. Instructure ultimately paid a ransom to prevent the leak from going public. This PeopleSoft campaign feels like the same playbook — identify a widely deployed enterprise platform, find the zero-day, extract everything valuable, and monetize.

The pattern is clear: threat actors are treating enterprise application vendors as attack surface multipliers. One vulnerability in PeopleSoft doesn't just compromise one organization — it potentially compromises hundreds. For a deep dive into how this campaign specifically impacted the University of Nottingham, see our breakdown: From Zero-Day to Student Records: Deconstructing the Attack on Nottingham's Database.

Conclusion and Remediation

Let's cut through the noise: CVE-2026-35273 is a wake-up call that should keep security teams up at night. The 'security vacuum' between first known exploit and official vendor patch is a period of maximum risk, and ShinyHunters proved that point with brutal efficiency. Here's what you need to do, and here's why it matters.

Immediate Actions:

1. Apply Oracle's emergency mitigation now. Don't wait for the full patch. Every hour you delay is an hour a determined attacker has to work.
2. Restrict access to vulnerable endpoints. Block external access to /PSEMHUB/ and /PSIGW/HttpListeningConnector at your perimeter. These should never be internet-facing without proper authentication and encryption.
3. Review logs aggressively. Look for suspicious requests targeting those paths. If your WebLogic instances are logging, you probably have evidence of scanning or exploitation already.
4. Inspect servers for IOCs. Check for unexpected .jsp webshell files, unauthorized binaries in PSEMHUB folders, suspicious directories (logs, persistantstorage, scratchpad), and recently modified XML files that could maintain persistence.
5. Block attacker IPs at the perimeter. The cluster at 142.11.200.186-190, plus 108.174.202.99 and 176.120.22.24, should be blocked immediately.

Longer-Term Posture:

The real problem here isn't just this one vulnerability. It's the structural weaknesses that made 300+ instances vulnerable in the first place. Organizations need to accelerate patch management beyond annual or quarterly cycles for high-CVSS flaws. Compartmentalize PeopleSoft behind MFA and Zero Trust principles — treat it like the crown jewel it is. Deploy SIEM/SOAR for anomaly detection on application-layer logs. Run regular security audits and red-team exercises that simulate zero-day exploitation scenarios. And critically, minimize the PII stored in legacy systems wherever possible.

This attack on university PeopleSoft installations isn't an anomaly. It's a manifestation of how threat actors are adapting to vulnerabilities in widely deployed enterprise applications. The academic sector needs to acknowledge they're targets of sophisticated, zero-day extortion campaigns — and act like it. Timely patch management can't be an afterthought. It has to be embedded in a proactive, risk-aware security culture that treats every unpatched system as an open invitation. For additional guidance on CISA's mandatory remediation directives for critical Oracle vulnerabilities, see: Mandatory Remediation: CISA Addresses Critical Oracle WebLogic Security Risk.