Oracle PeopleSoft critical bug chains three SSRF flaws together

CVE-2026-35273, exploited by ShinyHunters since May, comprises three chained vulnerabilities in Oracle PeopleSoft. The root cause is a server-side request forgery (SSRF) allowing attackers to reach an internal management interface by exploiting the system's trust of its loopback address. Oracle patched all three flaws under a single CVE identifier in June. Organizations should verify PeopleSoft patches have been applied.