CVE-2026-35273: Oracle PeopleSoft — FBI Employee Data Exposed (June 2026)

CVE-2026-35273 — Oracle PeopleSoft

CVE-2026-35273 is a critical zero-day vulnerability in Oracle PeopleSoft, exploited in the wild by the ShinyHunters group to compromise the FBI’s employee data. The flaw enabled unauthorized access and exfiltration of sensitive information, with no patch or mitigation guidance available as of June 2026.

Attack Vector

Attackers leveraged an undisclosed flaw in PeopleSoft, bypassing authentication and privilege controls to access internal FBI systems. The exploitation required network access to the affected PeopleSoft instance but did not rely on insider credentials. ShinyHunters used this vector to extract employee records and disrupt the FBI’s PeopleSoft-based jobs portal. No specific indicators of compromise (IOCs) have been released.

Who Is at Risk

All organizations running Oracle PeopleSoft, especially those exposing the application to the internet or with weak network segmentation, are at risk. The FBI is confirmed compromised, with their entire employee database exposed and job portal operations disrupted. Enterprise users of PeopleSoft remain vulnerable until Oracle issues a fix.

Patch & Mitigate

• Patch: No patch or hotfix available as of June 2026. Monitor Oracle advisories for updates.
• Workaround: Restrict external access to PeopleSoft instances, enforce network segmentation, and review user permissions.
• Detect: Monitor for unusual access patterns, failed authentication attempts, and unexpected data exports in PeopleSoft and network logs.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploited a zero-day to gain entry into the FBI’s network via PeopleSoft.
• TA0007 — Discovery: Adversaries likely enumerated internal systems and user accounts post-compromise.
• TA0005 — Defense Evasion: Exploitation bypassed standard authentication and logging mechanisms.

Source: https://www.csoonline.com/article/4230892/despite-shinyhunters-arrests-after-fbi-jobs-data-breach-enterprises-still-have-no-answers-about-peoplesoft-risks.html