ShinyHunters Oracle PeopleSoft extortion
ShinyHunters exploited an Oracle PeopleSoft zero-day to compromise application infrastructure and steal data for extortion.
- Momentum score
- 84
- Impact
- High
- Confidence
- High
What it is
Attackers exploit a remote-code-execution flaw in Oracle PeopleSoft's Environment Management component, gain control of application infrastructure, and steal data for extortion. Mandiant observed exploitation beginning on May 27, 2026, before Oracle disclosed CVE-2026-35273 on June 10. That timing made it a zero-day during the initial campaign.
Why it is rising
Mandiant linked May and June activity to CVE-2026-35273 and notified more than 100 organizations with potentially exposed endpoints.
Six-month trajectory
Normalized weekly momentum for prototype validation
+22 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Use the campaign to explain why business applications belong in exposure-management programs.
- 02Connect rapid external discovery with containment before extortion follows compromise.
- 03Build content around reducing the patch-to-exploitation gap for enterprise applications.