A critical server-side request forgery (SSRF) vulnerability in Oracle’s PeopleSoft suite, tracked as CVE-2026-35273 with a CVSS score of 9.8, has been weaponized by the ransomware group ShinyHunters for over two weeks before Oracle issued a mitigation. Mandiant reports the group has targeted roughly 300 endpoints across 100 organizations since May 27, with 68% operating in higher education. The University of Nottingham confirmed a breach involving significant student data exfiltration after ShinyHunters published stolen archives.

From an architectural standpoint, this SSRF is particularly dangerous because it allows attackers to pivot from the PeopleSoft application server into internal network segments—effectively using a trusted service as a proxy. Oracle has released a stopgap mitigation but no full patch; this forces engineering teams to implement network-level controls, such as strict egress filtering and Web Application Firewall (WAF) rules blocking outbound requests to internal IP ranges. The delayed patch cycle introduces a classic trade-off: accept the risk of running a vulnerable service versus taking it offline, which can break critical HR and finance workflows.

Mandiant observed that ShinyHunters left a staging server exposed, containing attack tools and directories of ongoing targeting. For data engineers, the incident underscores the need for immutable backups, network segmentation between ERP systems and data lakes, and real-time SSRF detection via proxy logs. The extortion demands confirm that exfiltration—not just encryption—is the primary payload, making data lineage and access auditing essential for breach response.

Source: Ars Technica