A critical 9.8-rated zero-day vulnerability in Oracle's PeopleSoft suite, identified as CVE-2026-35273, has been actively exploited by the ransomware group ShinyHunters since May 27, 2026. The vulnerability, an SSRF flaw, has allowed the group to compromise approximately 100 organizations, predominantly in the higher education sector, including the University of Nottingham. Attackers utilized the flaw to map internal system configurations and exfiltrate large volumes of data for extortion purposes. While Oracle has provided stopgap mitigations, a full patch remains pending, and security firms Mandiant and Rapid7 are currently working to support affected entities with indicators of compromise.

A critical 9.8-rated zero-day vulnerability in Oracle's PeopleSoft suite, identified as CVE-2026-35273, has been actively exploited by the ransomware group ShinyHunters since May 27, 2026. The vulnerability, an SSRF flaw, has allowed the group to compromise approximately 100 organizations, predominantly in the higher education sector, including the University of Nottingham. Attackers utilized the flaw to map internal system configurations and exfiltrate large volumes of data for extortion purposes. While Oracle has provided stopgap mitigations, a full patch remains pending, and security firms Mandiant and Rapid7 are currently working to support affected entities with indicators of compromise.