Oracle addresses a PeopleSoft vulnerability identified as CVE-2026-35273 after reports that attackers are using it to compromise organizations. Multiple outlets report that the flaw enables unauthenticated remote code execution over the internet, allowing intrusion without requiring login. Bleeping Computer and The Next Web state that the vulnerability is actively exploited in attacks associated with ShinyHunters, including alleged data theft and breaches affecting more than 100 organizations. SecurityWeek and the other reports note that Oracle has released a patch for CVE-2026-35273, but Oracle’s public communications do not clearly confirm whether the exploited activity constitutes a specific “zero-day” at the time of disclosure. The Next Web also reports that Oracle’s advisory describes the vulnerability as critical and cites a very high CVSS score. Across sources, the common theme is that organizations using PeopleSoft are being warned to remediate promptly and that exploitation in the wild has been reported. Oracle’s exact position on whether the incident is definitively a zero-day is presented differently in the coverage, but the vulnerability’s severity and remote, unauthenticated exploitability are consistent.