95/100
Researchers say the PeopleSoft Enterprise PeopleTools issue tracked as CVE-2026-35273, exploited by ShinyHunters since May, is a chain of three flaws rooted in an SSRF that reaches an internal management interface because PeopleSoft trusts its loopback address. Oracle patched all three under the single identifier in June. Organisations running PeopleSoft should confirm the June patch is applied and review systems for compromise.