Trend Micro’s Zero Day Initiative disclosed three vulnerabilities in Oracle PeopleSoft on October 27, 2026. Mandiant released a report on September 25, 2026, regarding continued mass exploitation of CVE-2026-35273 by ShinyHunters.
Three PeopleSoft vulnerabilities disclosed
Zero Day Initiative disclosed three distinct vulnerabilities in Oracle PeopleSoft, including an SSRF in the Integration Gateway, external file‑path control in PSEMHUB, and untrusted XML deserialization. The flaws can be combined to achieve remote code execution.
SSRF in PeopleSoft Integration Gateway (ZDI-CAN-31816)
Attackers can send a POST request to /PSIGW/HttpListeningConnector with a HttpTargetConnector handler and a target URL such as http://127.0.0.1:8000, satisfying the validateClient check. The request includes a Data field that is forwarded to the target, giving full control over the payload.
File path control and deserialization leading to RCE (ZDI-CAN-31818, ZDI-CAN-31817)
The ExecuteProcessActivityCommand in PSEMHUB writes content to an absolute file path supplied by the attacker, allowing a web shell to be placed in the PSEMHUB WAR directory for immediate RCE. Additionally, a malicious XML file placed in envmetadata/data/environment/ is deserialized by XMLDecoder during HubServlet initialization, leading to further code execution.
Key facts and where they come from
- Zero Day Initiative first reported CVE-2026-35273 to Oracle on June 10, 2026.
TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026
- Three distinct vulnerabilities were reported across multiple PeopleSoft components.
we reported three distinct vulnerabilities across multiple PeopleSoft components.
- The SSRF vulnerability is identified as Bug 1 (ZDI-CAN-31816) in the PeopleSoft Integration Gateway.
Bug 1: PSIGW Server-Side Request Forgery (ZDI-CAN-31816)
- The SSRF allows attackers to make requests that satisfy validateClient and access RCE endpoints.
Spoiler alert: the SSRF allows attackers to make requests that satisfy this validation and access endpoints vulnerable to remote code execution (RCE).
- The default allowedhosts.properties includes a localhost entry, enabling loopback access.
We can see the localhost entry in the default allowedhosts.properties that ships with PeopleSoft:
