ShinyHuntersExploited Oracle PeopleSoft ZeroDay Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together the researchers who reported it said this week Oracle patched all three under a single identifier CVE202635273 in June Its root is a serverside request forgery SSRF that reaches an internal management interface because PeopleSoft trusts its own loopback address