U.S. CISA adds Oracle PeopleSoft Enterprise PeopleTools flaw to its Known Exploited Vulnerabilities catalog


U.S. CISA adds Oracle PeopleSoft Enterprise PeopleTools flaw to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
June 13, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle PeopleSoft Enterprise PeopleTools flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle PeopleSoft Enterprise PeopleTools flaw, tracked as CVE-2026-35273 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.

Oracle PeopleSoft Enterprise PeopleTools is the underlying technology platform used to build, run, administer, and customize Oracle PeopleSoft applications.

The flaw CVE-2026-35273 is a remote code execution vulnerability in Oracle PeopleSoft’s Environment Management component. No authentication required. No user interaction required. Just network access to the Environment Management Hub endpoint and you can take over the server.

This week, Mandiant and Google’s Threat Intelligence Group published an analysis of an active ShinyHunters campaign on June 11, one day after Oracle finally issued an advisory for the vulnerability being exploited. The gap matters: the activity ran from May 27 to June 9, meaning every organization hit during those two weeks was dealing with a zero-day, a flaw with no available patch and no official vendor warning. Sixty-eight percent of the more than 100 organizations Mandiant notified were universities and colleges, most of them in the United States.

“Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component.” reads the report published by Google. “The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints. Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day.”

PeopleTools versions 8.61 and 8.62 are confirmed affected; Oracle says earlier unsupported versions are likely vulnerable too.

The attackers left their staging infrastructure exposed, which is how Mandiant got a detailed look at the operation. Researcher @nahamike01 publicly flagged open directories on five sequential IP addresses, all running Python’s built-in HTTP server on port 8888. Mandiant triaged all five and found a shared .bash_history file, identical across every host, that laid out the entire operation in timestamped detail. If you’re going to run a sophisticated zero-day campaign against universities, at least password-protect your file server.

“The staging infrastructure hosted pre-configured Windows MeshCentral agent binaries disguised as Microsoft Azure services, specifically named meshagent32-azure-ops.exemeshagent64-azure-ops.exe, and meshagent64-v2.exe.” reads the report. “Static analysis indicates these agents were hardcoded to establish communication with the command and control (C2) server wss://azurenetfiles.net:443/agent.ashx.”

The domain was chosen to look like Microsoft Azure NetApp Files. MeshCentral is legitimate open-source remote management software, which means the traffic blends into normal administrative activity and doesn’t trigger obvious alerts.

The command history tells the full operational story. On May 27 at 22:14 UTC, the attackers installed MeshCentral version 1.1.59. Eleven minutes later they installed acme-client to automate Let’s Encrypt SSL certificate provisioning for azurenetfiles.net, giving their C2 a valid certificate. They then used MeshCentral’s CLI tool meshctrl.js to run commands on compromised endpoints: mapping Oracle PeopleSoft configurations, reading process scheduler config files, parsing internal host tables, and inspecting WebLogic XML configs to identify additional targets inside each victim network.

Attackers performed lateral movement through a script named [victim_abbreviation]_fanout.sh, written directly to /tmp on compromised hosts and executed remotely via MeshCentral. The script parses /etc/hosts for internal PeopleSoft node hostnames, then sprays a hardcoded list of usernames and passwords against each one over SSH. On successful login it copies a file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into WebLogic and Process Scheduler directories, both as an extortion marker and as a propagation confirmation the operators could verify remotely.

Exfiltration went out compressed with zstd, followed by an outbound SSH connection to 176.120.22.24, the IP hosting the public mirror of the ShinyHunters data leak site.

The University of Nottingham is among the first confirmed victims. Have I Been Pwned has indexed approximately 455,000 unique email addresses from the leaked data, covering current students and alumni, with names, addresses, phone numbers, passport numbers, and records on ethnicity and disabilities. ShinyHunters has said that victim outreach has only just started and most compromised organizations haven’t been posted yet.

For any organization running Oracle PeopleSoft right now, the immediate priority is isolation. Oracle’s guidance is to disable the Environment Management Hub service entirely on multi-server setups, or remove the PSEMHUB application on single-server setups. If neither is possible, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by June 15, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


macOS has a built-in screenshot tool that gets the basics right. You can take a screenshot, record your screen, and even annotate your captures. But the moment you want something more, like scrolling capture, advanced annotation tools, or a quick way to share your screenshots via a link, it starts to fall apart.

That’s where CleanShot X comes in. It’s a powerful screenshot and screen recording app for Mac that replaces the built-in screenshot tool. It feels as if the developers looked at the screenshot features in macOS and added everything that was missing.

Over the past few years, the app has added several new features I didn’t know I needed until it offered them. It has become one of my favorite Mac utilities, and in this article, I will show you its features that will convince you to buy the app instantly. 

Scrolling capture saves you from stitching screenshots together

One of the most frustrating limitations of macOS’s screenshot tool is that it can only capture what’s visible on your screen. If I need to capture a long webpage or a full chat history, I am stuck taking multiple screenshots and stitching them together. That wastes an unbelievable amount of time. 

CleanShot X solves this with its scrolling capture feature. I can trigger the scrolling capture, and CleanShot X automatically scrolls through the content and delivers a single image. I don’t even have to manually scroll the page if I don’t want to.

This feature alone saves me hours of time every month. If you have to deal with long screenshots, you should definitely try it out. 

Time delay capture lets you screenshot the impossible

Some screenshots are tricky to take because they require you to trigger something before capturing. For example, sometimes the on-screen feature you want to capture disappears as soon as you use a keyboard shortcut or click anywhere with your mouse. 

Sometimes, the on-screen elements appear for a short time, and by the time you hit the screenshot shortcut, they disappear. CleanShot X’s time delay capture gives me a few seconds to set things up before the screenshot is taken. I trigger the capture, put everything in place, and CleanShot X does the rest. 

It’s a small feature that solves a genuinely annoying problem.

Capture text from images with OCR

I love that CleanShot X has a built-in OCR function. It lets me capture text directly from any image or video on my screen. Although it happens rarely, I have come across websites that don’t let me copy content. With CleanShot X’s OCR function, that’s not an issue. 

I use this constantly when reviewing PDF documents with restricted permissions or watching a video on YouTube. It is far faster than typing things out manually, and it works surprisingly well. There are many apps that let you capture text with OCR, but since CleanShot X has this feature built in, I don’t need to install an extra app. 

Add beautiful backgrounds to your screenshots

If you share screenshots for work, tutorials, or social media, you know how plain a raw screenshot looks. CleanShot X lets me add beautiful backgrounds to my screenshots, turning a flat capture into something that looks polished and share-ready.

For backgrounds, I can choose from solid colors, gradients, or even my current desktop wallpaper. I can also adjust the padding and shadow, align the screenshot to the edges, and adjust the corner radius. It takes a few seconds and makes a huge difference in how professional your screenshots look.

Annotation tools that get the job done

While macOS’s screenshot tool lets you annotate your screenshots, the annotation tools inside CleanShot X are, in my opinion, the best available on the Mac. 

I can add arrows, text labels, shapes, highlights, and more. I can also change the weight and color of annotations. There are also multiple arrow styles I can choose from. I especially like the curved arrow style that lets me curve the arrows and make them pop. 

One of my favorite new additions is the “Highlighter” tool. It snaps to the text in a screenshot, which makes it really easy to highlight it before sharing. 

Then there’s the “Spotlight” tool that highlights your selection by darkening the rest of the screenshot. It’s perfect for drawing someone’s attention to a specific part of a screenshot. 

No matter what annotation tools you need, you can find them and more in CleanShot X. 

Hide sensitive information before you share

You can find hundreds of instances in the news where a prominent figure shared a screenshot and inadvertently revealed private information. Thankfully, CleanShot X has a dedicated tool to blur or black out sensitive information, so such accidents never happen.

I can choose to pixelate, blur, or completely black out the information. The best part is that I can also adjust the strength of these effects. It lets me blend in the hidden information so the blur doesn’t stand out from the rest of the screenshot. 

Video and GIF recording built right in

CleanShot X also lets you record your screen as a video or export directly as an optimized GIF. The GIF export is particularly useful for sharing quick demos or showing someone how to do something without creating a large video file. 

It can record the entire screen, a specific window, or a custom region. It can also show my mouse clicks and keyboard shortcuts. I can record my computer audio, my microphone, and webcam video. 

I love that it automatically adds the webcam video in the corner, so it doesn’t interfere with the rest of the recording. I can also change the video size and shape. All these features make it really easy to create video tutorials. 

Quick share with cloud links

Once you take a screenshot or finish a recording, you need to share it. Of course, you can easily share screenshots via messages or emails. But CleanShot X gives me a better way. 

Whenever I capture something, it opens a quick share overlay. I can use it to instantly upload my screenshots to CleanShot Cloud and grab a shareable link with a single click.

I no longer have to drag files into cloud storage, attach images to emails, or upload to third-party services. I capture it, click share, and paste the link. It is one of those workflow improvements that sounds minor until you use it every single day.

Capture beautiful screenshots with CleanShot X

CleanShot X has become one of my most dependable apps on Mac. In fact, all the screenshots you see in this article or any of my articles have been captured using CleanShot X. Yes, it’s a paid app, but it has paid its cost multiple times over with the time it has saved me. 

CleanShot X is available as a one-time purchase or through a SetApp subscription. If you want unlimited cloud storage, you have to pay for a monthly subscription. That will also get you advanced features like a custom domain and branding, password-protected link sharing, and more. 

For most users, the one-time purchase is more than enough, and it’s what I use. If you spend any time taking screenshots or recording your screen on a Mac, it is absolutely worth every penny.



Source link