A critical vulnerability in Oracle’s PeopleSoft software has been exploited by the ShinyHunters ransomware group, compromising data from over 100 organizations. The group used an SSRF (server-side request forgery) to target about 300 endpoints since May 27, with victims receiving extortion demands.

The University of Nottingham confirmed it was among the affected institutions, with gigabytes of student data stolen and published online by ShinyHunters. Over 68% of the targeted organizations are in higher education, highlighting a significant breach in academic cybersecurity.

While Oracle has acknowledged the severity of CVE-2026-35273, carrying a 9.8 out of 10 severity rating, they have only issued a temporary mitigation measure and not yet fully patched the flaw. This leaves many organizations exposed to similar attacks in the future.

Researchers warn that such breaches could become more common as critical vulnerabilities go unpatched for extended periods. The lack of immediate action by Oracle raises questions about their response times in addressing high-risk vulnerabilities.