CVE-2026-35273 is a pre-authentication remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools with a CVSS score of 9.8 out of 10. In practice, that means an attacker who can reach the PeopleSoft web layer over HTTP or HTTPS can run code on the underlying server without a username or password. No credential theft required, no phishing, no lateral movement to reach the initial foothold.

The root cause is a chain. It starts with a server-side request forgery through /PSIGW/HttpListeningConnector, PeopleSoft’s Integration Gateway endpoint, and lands in the Environment Management Hub at /PSEMHUB/hub, where an unsafe Java XMLDecoder deserialization step lets attacker-controlled data become executable code inside the WebLogic JVM. Rapid7 and Rescana both classified it as a critical, easily exploitable, remotely reachable flaw.

Only PeopleTools versions 8.61 and 8.62 are confirmed vulnerable in Oracle’s advisory. Both endpoints are the kind of internal-sounding paths that admins historically forgot to lock down at the perimeter, which is why the flaw hit so hard when it went live. It’s already in the CISA Known Exploited Vulnerabilities catalog.

Google Threat Intelligence Group and Mandiant track the group as UNC6240, publicly known as ShinyHunters. They’re a financially motivated extortion crew, not a nation-state actor. Their track record includes the mass Salesforce customer breaches earlier this year, the Snowflake credential campaign, and a long tail of retail and telecom victims going back to Ticketmaster in 2024.

The formula is consistent. Find a fresh vulnerability or exposed credentials in a widely deployed enterprise SaaS or ERP. Automate the exploitation to hit as many tenants as possible before disclosure. Exfiltrate data. Publish samples on dark-web leak sites and extort the organizations directly, sometimes emailing customers of the victim to increase pressure. Ransomware encryption is optional; the leverage is the data itself.

In this campaign, Mandiant confirmed exploitation activity between May 27 and June 9. ShinyHunters told BleepingComputer they had breached over 300 PeopleSoft instances across roughly 100 organizations. Mandiant later said they had notified more than 100 organizations of potential compromise, most of them in higher education. Nissan is the standout corporate name on that list.

Nissan’s breach notification, filed with the California Attorney General on June 26, spells out what the attackers may have accessed. The list is long. Contact information, banking information including account details used for direct deposit, Social Security numbers for US employees, Social Insurance Numbers for Canadian employees, National Identification Numbers for Mexican and Brazilian staff, plus financial and tax data and dependent and beneficiary information from HR records.

The scope is any current or former Nissan Americas employee whose data lived in the PeopleSoft environment during the exposure window. That covers workers in the United States, Canada, Mexico, and Brazil. Nissan has not published a total headcount for affected individuals, and its filings say the investigation is still ongoing.

The exposure isn’t just about identity theft. Banking data lets attackers reroute paychecks. Tax records enable fraudulent returns. Dependent information can be used to open credit lines under family members’ names. This is the kind of package that gets sold, resold, and combined with other leaked datasets for months.

The vulnerability was reported to Oracle through Trend Micro’s Zero Day Initiative, according to Rapid7’s writeup. Oracle published an out-of-band security alert on June 10, 2026, and released the patch the same day. Out-of-band alerts are unusual for Oracle, which normally batches security fixes into its quarterly Critical Patch Update cycle. That schedule signals how serious the company judged the exposure.

Mandiant published its threat intelligence report the next day, June 11, confirming that active exploitation had started on May 27, two weeks before Oracle’s advisory. That’s the two-week window during which attackers had a working exploit for a critical pre-auth RCE and defenders had nothing. Every unpatched, internet-exposed PeopleSoft instance in versions 8.61 or 8.62 was reachable in that gap.

Rescana’s analysis also flagged public proof-of-concept code circulating shortly after the advisory, which typically doubles or triples opportunistic exploitation attempts against slow-to-patch targets. CISA added the CVE to the KEV catalog quickly, forcing federal civilian agencies to remediate on a strict timeline. Private-sector organizations move slower, which is where the ongoing risk sits today.

Nissan activated its incident response plan immediately after Oracle notified the company. It engaged external cybersecurity consultants, isolated affected systems, worked with Oracle on remediation, and restricted payroll-related access. Employees can now only view electronic payslips or change direct-deposit details from company-managed networks or a corporate VPN, and additional identity verification steps are required before HR requests get processed.

The company also committed to offering free credit monitoring and dark web monitoring to affected staff where those services are available. That’s the standard response, and it’s better than nothing, but it’s reactive. Credit monitoring alerts you after fraud happens; it doesn’t prevent the initial fraudulent account from opening.

The gap is speed. Nissan filed its California breach notice on June 26, 16 days after Oracle’s advisory. Individual employee notifications are still rolling out as the investigation determines exact scope. During that gap, exposed data was already circulating in criminal marketplaces. Employees who want real protection can’t wait for the letter.