Mandiant warns of Oracle PeopleSoft vulnerability exploitation

What happened and what to do

On September 28, 2026, Mandiant warned that the ShinyHunters group is using workarounds to exploit a vulnerability in Oracle PeopleSoft. The advisory places this activity in a new campaign by the group, which recently claimed responsibility for an attack on the FBI jobs site. The advisory does not identify the flaw by number or describe the workarounds used.

Organizations running PeopleSoft can start by mapping exposed instances and versions in use, reviewing applicable security guidance, and checking access and activity logs for signs of exploitation. A monitoring process can centralize those logs and alert the responsible team to anomalous activity; the priority is reducing exposure and responding to potential incidents, not adding AI without a need.

How the consultancy can help

Wendelmaques can diagnose exposure in PeopleSoft environments, define a mitigation and monitoring scope, and implement the necessary controls and pipelines. It can also structure ongoing operations and alert reviews.

Next step

Send a brief description of your PeopleSoft environment and security concerns to receive a scoped proposal.