Oracle PeopleSoft Zero-Day: Las Vegas Cybersecurity Alert

What Las Vegas Businesses Need to Know Right Now

Last week, Oracle issued an emergency security advisory for CVE-2026-35273, a critical zero-day vulnerability in Oracle PeopleSoft PeopleTools carrying a CVSS score of 9.8 out of 10. The flaw enables unauthenticated remote code execution — meaning attackers can seize full control of an exposed system without a username or password. Within days of disclosure, cybersecurity firm Mandiant confirmed that threat actors had already breached more than 100 organizations and stolen data from over 300 PeopleSoft instances worldwide.

The group behind these attacks is ShinyHunters — one of the most prolific data extortion gangs active today. They’ve previously breached Ticketmaster, Snowflake-connected enterprises, and major educational platforms holding hundreds of millions of student records. Now they’ve turned their firepower on Oracle PeopleSoft, and any organization running an unpatched version is a live target.

Why Las Vegas and Clark County Businesses Are in the Crosshairs

You might be thinking: “We’re a small business — why would ShinyHunters target us?” The answer is in what Oracle PeopleSoft manages: HR data, payroll, finance records, student information, and patient databases. Across the Las Vegas Valley, Oracle PeopleSoft is embedded in universities like UNLV and the College of Southern Nevada, Clark County government operations, Valley Health and Sunrise Health System providers, and large hospitality companies managing thousands of employee records across the Strip and beyond.

Even if your company doesn’t run PeopleSoft directly, your vendors and partners might. A ShinyHunters breach at a third-party payroll processor, HR platform, or benefits administrator could expose your employees’ Social Security numbers, direct deposit accounts, and personal data — without any direct attack on your own network. Third-party risk is one of the fastest-growing attack surfaces for Las Vegas SMBs, and CVE-2026-35273 is exactly the kind of supply-chain entry point threat actors exploit to reach businesses they could never breach head-on.

How ShinyHunters Is Exploiting This Flaw: Technical Breakdown

Mandiant’s analysis of the live ShinyHunters campaign reveals a multi-stage attack chain that moves from initial exploitation to full data exfiltration in a matter of hours:

• Vulnerable versions: Oracle PeopleSoft PeopleTools 8.61 and 8.62 — both widely deployed in enterprise and government environments
• Attack vector: Unauthenticated HTTP requests targeting the /PSEMHUB/ and /PSIGW/HttpListeningConnector endpoints, reachable without any credentials
• Attack chain: ShinyHunters used a “gadget chain” combining previously known PeopleSoft vulnerabilities with CVE-2026-35273 to achieve unauthenticated remote code execution in a single pass
• Post-exploitation: WebShell files dropped in WebLogic application directories, lateral movement via stolen or hardcoded credentials, data compressed and exfiltrated to attacker-controlled servers
• Evasion: Command-and-control infrastructure disguised as Microsoft Azure services to bypass conventional security detection
• Indicators of compromise: Unexpected .jsp webshell files in WebLogic directories; unauthorized folders named persistantstorage, logs, or scratchpad; recently modified XML files on the server

What’s at Stake for Las Vegas Businesses

• ⚠ Stolen employee records — Social Security numbers, salaries, and direct deposit banking information
• ⚠ Exposure of customer PII triggering mandatory breach notification under Nevada NRS 603A (45-day clock)
• ⚠ Extortion demands from ShinyHunters with a credible public data-leak threat — this group has published stolen records before
• ⚠ Third-party payroll or HR vendor breach cascading into your employee and customer data
• ⚠ Operational shutdown while affected systems are isolated, forensically examined, and rebuilt
• ⚠ Regulatory fines for healthcare (HIPAA) and government contractor organizations (CMMC) that fail to disclose breaches within required windows

Three Actions Las Vegas Businesses Must Take This Week

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas has protected Clark County businesses for years — from healthcare providers and construction firms to professional services companies and government contractors. When critical vulnerabilities like CVE-2026-35273 emerge, the organizations that weather the storm are the ones with managed cybersecurity partners actively monitoring their environment around the clock. We push emergency mitigations the same day Oracle issues advisories, hunt for indicators of compromise before attackers establish persistence, and stand ready to respond if the worst happens — so you can run your business instead of managing a breach.