ShinyHunters Oracle PeopleSoft Breach: 100+ Orgs [2026]

What We Know

Multiple security write-ups and reporting say a critical unauthenticated remote-code-execution vulnerability in Oracle PeopleSoft (tracked as CVE-2026-35273) was exploited in June 2026. ToolsLib and other technical write-ups describe the flaw as allowing an attacker to issue a single unauthenticated HTTP request to gain access; vendors and security vendors published detection guidance and alerts after the issue emerged.

Reporting and industry blogs attribute the exploitation to the data-theft group ShinyHunters, which claims successful intrusions against over 100 organizations during a roughly two-week window in June 2026. A TechRadar report cites the U.S. National Association of Insurance Commissioners (NAIC) confirming a breach and quotes ShinyHunters’ claim of roughly 3.1 TB of data stolen. Other accounts and blogs note that affected victims include higher-education institutions and at least one international body (reporting links this incident to a Council of Europe disclosure involving employee records). Security vendors such as HookProbe and others published detection and mitigation guidance after the vulnerability was publicly discussed.