iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The FBI confirmed unauthorized activity affecting FBIJobs.gov, but public reporting has not established how attackers got in or confirmed ShinyHunters’ claim that they used a second PeopleSoft zero-day. That unresolved incident is separate from CVE-2026-35273, a documented PeopleSoft vulnerability Oracle patched on June 10, 2026, which Mandiant later reported was being exploited again against organizations that had relied on workarounds instead of installing the patch.
What is confirmed about the FBI jobs portal breach?
The FBI acknowledged unauthorized activity affecting its jobs portal, FBIJobs.gov. In an October 5, 2026 report, CIO said the specific technical entry point had not been publicly disclosed. ShinyHunters claimed responsibility and alleged it exploited a second, previously undocumented PeopleSoft vulnerability, but the FBI and Oracle had not publicly confirmed PeopleSoft’s role or the alleged flaw in the reporting available at that time.
That means the breach is real as an acknowledged incident, while the claimed PeopleSoft cause remains unverified. ShinyHunters’ assertions about stolen records or their volume should likewise be treated as attacker claims, not established totals.
Free tools Windows power users keep installed
One-click scans. No signup required.
How does the FBI claim differ from the documented PeopleSoft flaw?
CVE-2026-35273 is a distinct, documented PeopleSoft vulnerability. Mandiant reported that ShinyHunters exploited it against academic institutions from May 27 through June 9, 2026, before Oracle released a patch on June 10. In September, Mandiant reported renewed exploitation, including against organizations that had used workarounds but had not applied Oracle’s patch. Mandiant described activity across multiple sectors; this does not establish that every PeopleSoft customer, or every organization in those sectors, was affected.
#1 Best Overall
- Used Book in Good Condition
| Question | CVE-2026-35273 | Alleged second flaw in the FBI incident |
|---|---|---|
| Confirmation | Documented vulnerability; Mandiant reported exploitation. (Mandiant, as reported by The Record, September 28, 2026.) | ShinyHunters’ allegation; the FBI and Oracle had not publicly confirmed it as of CIO’s October 5, 2026 report. |
| Patch status | Oracle released a patch on June 10, 2026. Check Oracle’s guidance and your support team for the instructions that apply to your installed configuration. | No patch or confirmed vulnerability was identified in the cited reporting. |
| Exploitation evidence | Mandiant reported exploitation from May 27 to June 9, 2026, and renewed activity in September, including against organizations that had not patched after using workarounds. | The FBI confirmed unauthorized portal activity, but public reporting did not establish its entry point or confirm PeopleSoft was involved. |
| What an operator should conclude | Verify patch status and investigate signs of compromise in the relevant PeopleSoft environment. | Do not assume the FBI incident proves your system is exposed to a second zero-day; investigate if your own evidence warrants it. |
What could exploitation of CVE-2026-35273 expose?
Mandiant said exploitation could give an attacker operating-system control or expose PeopleSoft configuration files, database connection strings and application data. It advised affected organizations to review database query logs for access to sensitive human-resources, payroll and student-record tables. Such activity can help an incident-response team assess possible access; it does not, by itself, prove that records were stolen.
Mandiant also advised affected organizations to prepare for possible extortion communications and monitor for public exposure of stolen data. The advice concerns organizations that may have been affected; it is not evidence that every PeopleSoft customer experienced data theft.
What should a PeopleSoft administrator do now?
- Verify the documented vulnerability’s status. Confirm your installed PeopleSoft configuration and whether Oracle’s June 10, 2026 patch for CVE-2026-35273 is installed. Use Oracle’s official guidance and your organization’s support team to determine the appropriate patch and remediation steps.
- Review exposure of relevant services. CIO quoted Frank Dickson, principal analyst at Dickson Research, advising customers to disable or remove the Environment Management Hub if it is unused, and to remove the Environment Management Hub and Integration Broker from the public internet. Apply exposure changes in line with your architecture and operational requirements.
- Search logs beyond a literal path match. Dickson advised searching for encoded variants of the PSEMHUB path, not only the plain-text string. A match merits investigation; absence of a match is not proof that an environment is uncompromised.
- Escalate evidence of a web shell. Dickson said to treat a discovered web shell as evidence that the server is compromised and rotate every credential it could read. Follow Oracle guidance and your incident-response procedures to contain and investigate the system.
- Review database activity. Following Mandiant’s advice, examine queries involving HR, payroll and student-record tables for suspicious access, and have responders assess whether any data was accessed or exposed.
These steps address the documented vulnerability and prudent investigation of suspicious activity; they cannot establish whether the FBI portal was compromised through PeopleSoft or rule out an unconfirmed flaw.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do the arrests answer the technical questions?
No. CIO reported arrests of suspected ShinyHunters members in the Netherlands and Jordan in September 2026. The report connected the arrests to the pursuit of the group, but said details of the FBI portal breach remained incomplete. Arrests are a law-enforcement development, not confirmation of the incident’s attack vector or of the alleged second zero-day.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
