A cluster of data-breach disclosures arriving in early July 2026 — from carmaker Nissan, the US insurance-regulator body NAIC, and a growing list of universities — traces back to a single cause: a zero-day vulnerability in Oracle PeopleSoft that a data-extortion group exploited weeks before Oracle shipped a fix. The disclosures are the visible edge of a campaign that Google's Mandiant has tied to more than 100 organisations.

The flaw and the window

The vulnerability, CVE-2026-35273, is a critical unauthenticated remote code execution flaw, rated 9.8, in the Environment Management component of Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, with Enterprise Applications also affected. Oracle disclosed it in an out-of-band security alert on 10 June 2026 and released mitigations.

The problem is that the fix arrived after the damage. Mandiant and Google's Threat Intelligence Group, which investigated the campaign, found that exploitation ran from 27 May to 9 June 2026 — meaning the flaw was attacked as a zero-day, before any advisory existed, for roughly two weeks in which any internet-reachable, unpatched PeopleSoft instance was exposed. Mandiant attributed the activity to the group it tracks as UNC6240, which it has associated with the ShinyHunters ecosystem, and said it notified more than 100 organisations whose systems correlated with the targeting. The actors themselves claimed to have hit around 300 PeopleSoft instances across more than 100 organisations — a figure that sits in the same order of magnitude as Mandiant's notification activity, without independently confirming the actor's numbers.

PeopleSoft is a productive target for a specific reason. It is enterprise resource planning software that concentrates exactly the data an extortion crew monetises: employee master records, payroll, tax withholding, direct-deposit bank details, government identification numbers, dependents and beneficiaries. A single successful intrusion yields a victim's entire workforce file. That is the same logic that made file-transfer tools such targets in earlier large-scale exploitation campaigns, applied now to the system at the centre of HR, payroll and finance.

What is confirmed, and what it exposed

Two victims have put specifics on the record. Nissan, in a breach notification filed with the California Attorney General, said its Americas operation uses PeopleSoft to manage employee information and that attackers may have taken data belonging to current and former employees in the United States, Canada, Mexico and Brazil — potentially including Social Security numbers, banking information, and financial and tax data, along with dependent and beneficiary records. Nissan framed this as a possibility under ongoing investigation, not a confirmed total. The National Association of Insurance Commissioners separately confirmed it was targeted and said public data was taken.

Beyond those, the confirmed victim list remains short relative to the scale Mandiant describes. The education sector appears to be among the most visibly affected so far, with institutions including Illinois Central College and Moody Bible Institute named, and the University of Nottingham widely believed to be among those hit. That gap — more than 100 organisations notified, only a handful publicly identified — means the true scope of this campaign is still emerging, and more disclosures should be expected.

The conceptual root cause — and what to do

At a conceptual level, the flaw let an unauthenticated attacker reach an internet-facing PeopleSoft management component and execute code without credentials. From that foothold, the actors deployed a legitimate remote-management tool repurposed for command-and-control and moved laterally inside compromised networks using credential spraying. The specific exploit paths, tooling identifiers and indicators are documented by Oracle and Mandiant for defenders and are deliberately not reproduced here.

For anyone running PeopleSoft, the defensive steps are well defined:

  • Apply Oracle's out-of-band mitigations and the fixed PeopleTools version, following Oracle's security alert and Patch Availability Document.

  • Disable the Environment Management Hub service where it is not required, or remove it in single-server configurations, per Oracle's guidance; where it must run, block external access to the internet-facing PeopleSoft components at the perimeter.

  • Review web-tier logs and the web-tier filesystem for the compromise indicators published by Mandiant, rather than assuming a clean patch means a clean system.

  • Treat any instance that was internet-reachable and unpatched during the 27 May–9 June window as potentially compromised, and move to incident-response and breach-notification workflows — including credential resets for affected staff — rather than treating patching as the end of the task.

That last point is the one defenders most need to internalise. As Certes chief technology officer Simon Pamplin observed, patching the flaw does nothing for data already exfiltrated during the exploitation window. For the organisations caught in this, the vulnerability problem and the breach problem are now two separate jobs.

A note on Oracle's position

Oracle mitigated the vulnerability and, in its advisory, urged immediate action as a high-priority risk-reduction measure — but it has not publicly confirmed that the flaw was exploited in the wild. Mandiant's investigation supplies that confirmation. Trend Micro's enterprise arm, credited by Oracle for reporting the vulnerability, told reporters it was seeing limited exploitation, with its investigation ongoing. The practical takeaway for defenders is unchanged regardless of how the vendor characterises it: the exploitation is independently confirmed, and the response is the same.

Key Takeaways

  • CVE-2026-35273 is a critical (9.8) unauthenticated RCE in Oracle PeopleSoft's Environment Management component; Oracle issued an out-of-band alert and mitigations on 10 June 2026.

  • Mandiant attributed the campaign to UNC6240, associated with the ShinyHunters ecosystem, and confirmed zero-day exploitation from 27 May to 9 June 2026, notifying 100+ organisations.

  • Early-July disclosures — Nissan (employee SSNs, banking, tax data across four countries) and NAIC among them — trace to this single flaw; education is among the most visibly affected sectors so far.

  • Patching does not recover data already stolen in the zero-day window; affected organisations face a separate breach-response and notification task.

  • Exploit paths, tooling and indicators are withheld here; defenders should follow Oracle's and Mandiant's published guidance to disable the affected component, block external access and hunt for compromise.