CVE-2026

* Mandiant released a report on continued mass exploitation of CVE-2026-35273 by the ShinyHunters group on September 25, 2026.
* TrendAI reported the CVE to Oracle on June 10, 2026.
* Three distinct vulnerabilities were reported across multiple PeopleSoft components under a single CVE.
* The SSRF vulnerability exists in the PeopleSoft Integration Gateway (PSIGW).
* PSEMHUB implements the validateClient method to restrict access to its web endpoints.
* PSIGW allows specifying an HttpTargetConnector, enabling SSRF.
* A File Path External Control vulnerability exists in the ExecuteProcessActivityCommand handler of PSEMHUB.
* The SSRF allows access to PSEMHUB by leveraging localhost access granted by default in the validateClient check.
* Arbitrary file writing via ExecuteProcessActivityCommand targets the PeopleSoft server's filesystem.
* Deserialization of untrusted data within PSEMHUB triggers code execution during initialization.

The sequence describes a potent convergence where an input validation failure (SSRF) bypasses intended access controls, creating a bridge to another component (PSEMHUB), which then suffers from a secondary control failure (External File Path write). The critical insight lies in the systemic trust placed on internal loopback addressing and the potential for application logic flow errors during initialization. The persistence of this threat depends less on the novelty of the individual vulnerabilities and more on the architectural assumption that internal network access, especially localhost access, is implicitly trusted by security checks like validateClient. This suggests a pattern where perimeter controls are effectively bypassed through internal service interaction rather than external penetration. The risk is amplified when file operations (writing a web shell) and data processing (deserialization) can be chained together to achieve system-level control. The implication is that layered defense must account not just for network ingress, but for the implicit trust relationships established between internal management components.
Bridge Questions: How should organizations redesign validation logic to strictly enforce context-aware access boundaries even within loopback communication? What systemic auditing mechanisms are necessary to detect chained exploitation of application logic flaws across disparate components? How does the reliance on default localhost allowance change the security posture when dealing with internal service interfaces?