[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUPLnIr6xB0pk8Z_nlVvU4WLTeDL0ZbZGgJwV9CTFwIc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"612d8bb6-d800-4b0f-8be0-794ea638c1b2","oracle-peoplesoft-zero-day-chain-exploited-before-patch-deployment","7d9ae881-5907-47ce-a37c-7de51c67194a","Oracle PeopleSoft Zero-Day Chain Exploited Before Patch Deployment","ShinyHunters exploited a chain of three distinct flaws in Oracle PeopleSoft — SSRF, logging function abuse, and malicious XML processing — that together enabled unauthenticated remote code execution, patched collectively as CVE-2026-35273 in June. The root issue is that organizations were running unpatched internet-facing enterprise software during an active exploitation window that began in May, weeks before the official fix. Chained exploits like this are especially dangerous because each individual flaw may appear low-severity in isolation, masking the critical risk of their combination. This incident underscores that vulnerability management programs must account for complex exploit chains, not just standalone CVEs, and that patching cadence for internet-facing systems must be treated as a priority response.","**Immediate actions:**\n- Apply Oracle's June patch for CVE-2026-35273 to all PeopleSoft instances without delay, prioritizing internet-facing deployments.\n- Perform an emergency scan of all PeopleSoft environments to identify unpatched or exposed instances and restrict external access until patching is confirmed.\n\n**Long-term improvements:**\n- Implement a risk-tiered patch management policy that mandates accelerated patching SLAs (e.g., 24–72 hours) for critical, internet-facing enterprise applications.\n- Maintain a continuously updated asset inventory of all internet-facing systems to ensure no instance is overlooked during vulnerability response cycles.\n- Engage in threat intelligence subscriptions to receive early warning of active zero-day exploitation campaigns targeting enterprise software.\n\n**Detection measures:**\n- Deploy web application firewall (WAF) rules and anomaly-based detection to identify SSRF attempts targeting internal loopback addresses from PeopleSoft endpoints.\n- Enable detailed server-side logging for PeopleSoft application activity and alert on unexpected outbound internal requests or unusual XML processing events.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies; organizations running critical enterprise ERP systems like PeopleSoft without rapid patch deployment processes fall short of this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly; any PeopleSoft environment processing payment-related data that remained unpatched during active exploitation would be in direct violation.","SI-2 requires organizations to identify, report, and correct information system flaws — formalizing an emergency remediation process for critical CVEs would have driven faster deployment of Oracle's patch.","PeopleSoft instances running without the June patch exemplify the risk of outdated components; OWASP A06 specifically warns that unpatched enterprise software is a primary attack vector for remote code execution.","Active exploitation began in May while the patch did not arrive until June; a continuous vulnerability management program with defined patching SLAs for critical internet-facing systems would have minimized the exposure window.","This control mandates timely identification and remediation of technical vulnerabilities in systems; had organizations followed it rigorously, the chained PeopleSoft flaws would have been patched before ShinyHunters could exploit them.","The SSRF component of the exploit chain bypassed trust checks by spoofing the internal loopback address, highlighting a failure in access control design that this control — governing how trust is established and verified — would directly address.","published","2026-10-28T08:21:06.039309+00:00","2026-10-28T08:21:06.019+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fshinyhunters-exploited-oracle.html","shinyhunters-exploited-oracle-peoplesoft-zero-day-turns-out-to-be-three-chained-1417a6","ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]