# Researchers identify three-flaw chain behind PeopleSoft server takeovers

_Published Wednesday, October 28, 2026 at 2:18 AM EDT · Security · Latest · Tier 2 — Notable_

![Researchers identify three-flaw chain behind PeopleSoft server takeovers — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgiU-iVEycp9z-2dprGJhgl046M9ZvG7kGGwaXNzgFJg7XDubOoWWLvEuKAOczIcGuXU04db46Xa6pRMKO36ZS7Fu8Xkv7mNuPjHUS0zLTHkGlNWNRD2DLCznPf6jqvqamZSZGMBXSzh9gMYm-9sR-y7OgN7i7n6x0dfYxyl9QftWlfuQw0mpTteHy57k/s1700-nu-rw-lo-l85-e365/sh.jpg)

The Oracle PeopleSoft vulnerability exploited by ShinyHunters combines three flaws, researchers at the Zero Day Initiative said this week. Oracle patched them under a single identifier, CVE-2026-35273, in June; ZDI is working with Oracle to obtain separate identifiers.

The chain lets an unauthenticated attacker reach an internal management interface through requests that appear to originate from the server itself, then execute code. One route uses a malicious XML file rather than a web shell, leaving less for standard detection to catch. Mandiant says blocking administrative paths with web application firewall rules is no substitute for patching.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html)

---
Canonical: https://techandbusiness.org/newswire/IelEu9dnp7vblZs3PrRPfj
Published: 2026-10-28T06:18:41.517Z
Story chronology: 2026-10-28T06:04:00.000Z
Retrieved: 2026-10-28T09:12:01.969Z
Publisher: Tech & Business (techandbusiness.org)