ShinyHunters Hits 100+ Universities with Oracle Zero-Day CVSS 9.8

The ShinyHunters group exploited CVE-2026-35273, an unauthenticated RCE in Oracle PeopleSoft, against more than 100 organizations before the June 10 advisory.

ShinyHunters operated for two weeks in the shadow of a zero-day bug in Oracle PeopleSoft Enterprise PeopleTools, exploiting CVE-2026-35273 before Oracle published its security advisory on June 10, 2026. The group, tracked as UNC6240 by Mandiant/Google, hit more than 100 organizations with exposed endpoints, with a 68% concentration in the higher education sector. The campaign left concrete technical traces: staging servers with exposed .bash_history, MeshCentral agents disguised as Azure services, and credential-spraying scripts for lateral movement.

Key Takeaways

CVE-2026-35273 is an unauthenticated RCE with CVSS 9.8 affecting Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, per the official NVD record.
Active exploitation ran from May 27 to June 9, 2026, preceding the Oracle advisory of June 10: Google Threat Intelligence Group/Mandiant confirms it was a zero-day.
Mandiant directly notified more than 100 organizations with exposed vulnerable endpoints; 68% belong to the higher education sector.
The University of Nottingham confirmed a breach affecting 454,600 current and former students, with data including contact details, passport numbers, enrollment information, and tuition payment records.

The Vulnerability: A Keyless Entry into the Heart of PeopleSoft

The official NVD record for CVE-2026-35273 assigns a CVSS 3.1 score of 9.8, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The bug resides in the Environment Management Hub (PSEMHUB) component of PeopleSoft Enterprise PeopleTools: HTTP endpoints that lack authentication for critical functions, classified under CWE-306.

This configuration allows a remote attacker to execute arbitrary code via crafted POST requests, without the need for valid credentials. The officially affected versions are 8.61 and 8.62. The brief does not confirm exploitability of earlier unsupported versions; an aggregator source reports Oracle considers impact on prior releases "likely," but this indication is not verified in the primary dossier.

The Attack Chain: From PSEMHUB to MeshCentral, Mandiant's Signature

Technical analysis by the Google Threat Intelligence Group, based on exposed attacker infrastructure, reconstructs the action chain with forensic precision. After initial exploitation of PSEMHUB, operators deployed MeshCentral agents — a legitimate remote management tool — with deliberately modified filenames: meshagent32-azure-ops.exe and meshagent64-azure-ops.exe. These agents communicated with a command-and-control server at wss://azurenetfiles.net:443/agent.ashx, impersonating Microsoft Azure services to blend into enterprise traffic.

Lateral movement occurred via an SSH script named [victim]_fanout.sh, which performed credential-spraying against internal hosts listed in /etc/hosts. On a compromised staging server, Mandiant analysts recovered the file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, a defacement and extortion marker confirming ShinyHunters activity. The group operates on a data-theft extortion model, without encrypting compromised systems.

The Education Target: Why Universities Are in the Crosshairs

The sectoral distribution of notified victims reveals a deliberate pattern. 68% of the more than 100 organizations contacted by Mandiant belong to higher education: an IT ecosystem characterized by administrative decentralization, heterogeneous budgets across departments, and massive presence of legacy systems exposed to the Internet for student and staff remote access needs.

The University of Nottingham represents the only publicly confirmed victim with quantitative detail: 454,600 current and former students affected, with exposure of personal and administrative data. The brief does not document further official confirmations; names such as Kodak, Amazon One Medical, and Council of Europe appear in a single aggregator source, without independent corroboration in the primary dossier.

"Because this activity predates Oracle's June 10, 2026 advisory, the vulnerability was exploited as a zero-day."
— Google Threat Intelligence Group/Mandiant

The Institutional Response: CISA and the Compression of Timelines

CISA added CVE-2026-35273 to the Known Exploited Vulnerabilities Catalog on June 12, 2026, with a deadline for mitigation application set for June 15, 2026 under Binding Operational Directive 26-04. The catalog explicitly flags the vulnerability as "Known To Be Used in Ransomware Campaigns." The 72-hour window between KEV inclusion and compliance deadline is exceptionally compressed, reflecting the severity perceived by the federal agency.

Oracle published an out-of-cycle security alert on June 10, 2026, crediting Trend ZDI/Trend Research for reporting the vulnerability. According to an aggregator source, the patch document would be restricted to Oracle support accounts, with effective availability not clearly documented in the primary dossier. The brief does not confirm whether exploitation continued after the advisory publication.

Immediate Actions

Operational recommendations emerge directly from the technical data documented in the dossier:

Isolate PSEMHUB endpoints exposed to the Internet. Mandiant identified these endpoints as a necessary condition for exploitation: their public exposure represents the verified entry vector.
Hunt for disguised MeshCentral indicators. The files meshagent32-azure-ops.exe and meshagent64-azure-ops.exe, with connections to azurenetfiles.net, constitute documented compromise artifacts.
Analyze [name]_fanout.sh scripts in /etc/hosts. This lateral movement mechanism via SSH credential-spraying is confirmed in Mandiant's forensic analysis.
Check for the file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT. Its detection indicates completed compromise and extortion marking by ShinyHunters.

The Campaign's Significance: ERP as a New Attack Surface

The CVE-2026-35273 campaign marks a turning point in ShinyHunters' modus operandi, historically associated with SaaS credential theft. The shift to zero-day exploitation in enterprise ERP software — often maintained with limited resources, perceived as "too boring to be attacked" — significantly widens the risk surface for organizations that have not prioritized segmentation of legacy systems.

Higher education, with its decentralized IT model and pressure for always-accessible services, proved the ideal proving ground for this industrialization of targeting. It is not the sophistication of the bug that makes the difference — an unauthenticated RCE on exposed endpoints is a classic — but the speed with which a criminal group converted vulnerability knowledge into compromises at scale before the vendor could react.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references