Oracle published an advisory Thursday for a critical unauthenticated remote code execution vulnerability in its PeopleSoft HR and payroll platform, one day after the ShinyHunters cybercrime group claimed responsibility for compromising over 100 organizations running the software. At the time of writing, no patch exists; Oracle has only released mitigation steps.

Mandiant confirmed the flaw is the same zero-day ShinyHunters is actively exploiting. The bug requires no authentication—no password, no session token—meaning any internet-facing PeopleSoft server is potentially reachable. This is a classic supply-chain attack surface: one vulnerable software version, hundreds of downstream targets.

Mandiant notified over 100 global organizations, roughly two-thirds in U.S. higher education. While some blocked the activity, others suffered data exfiltration, with stolen records published on ShinyHunters’ leak site. The attackers claim to have exfiltrated student PII including names, addresses, SSN-adjacent fields, GPAs, and ethnicity markers.

From an architectural standpoint, this incident highlights a recurring pattern: ShinyHunters identifies a single enterprise SaaS or on-prem platform (Salesforce, Gainsight, Instructure’s Canvas, now PeopleSoft), then mass-scans for exposed instances. The engineering takeaway is that zero-day response plans must assume internet-facing HR systems are high-value, high-risk endpoints. Mitigations like network segmentation, WAF rules, or temporary decommissioning of public endpoints should be pre-scripted, not improvised after a CVE drops.

Organizations relying on PeopleSoft should apply Oracle’s mitigations immediately and audit logs for signs of unauthenticated access. This is not a theoretical vulnerability—it’s being weaponized at scale, and the patch cycle has not yet begun.

Source: TechCrunch