Critical RCE Vulnerability in Oracle PeopleSoft Exploited by SHADOW-AETHER-015

Oracle disclosed CVE-2026-35273, a pre-authentication RCE in PeopleSoft PeopleTools (versions 8.61 and 8.62) reported by TrendAI and publicly alerted on June 10, 2026. Mandiant confirmed active exploitation in a campaign labeled SHADOW-AETHER-015 that impacted more than 100 organizations—mainly in higher education—between May 27 and June 9, 2026; the exploit is particularly stealthy because it executes code on server restart without generating outbound traffic, and TrendAI has provided detection guidance.