CVE-2026-35273
9.8CVSS base score · critical (NVD)
97%Chance of exploitation in the next 30 days (FIRST EPSS)
ExploitedIn CISA KEV
What happened
CVE-2026-35273, exploited by ShinyHunters since May, comprises three chained vulnerabilities in Oracle PeopleSoft. The root cause is a server-side request forgery (SSRF) allowing attackers to reach an internal management interface by exploiting the system's trust of its loopback address. Oracle patched all three flaws under a single CVE identifier in June. Organizations should verify PeopleSoft patches have been applied.
From the Intel60 brief of Oct 28, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalOracle PeopleSoft critical bug chains three SSRF flaws togetherOct 28, 2026