ShinyHunters Claims FBI Job Portals Breached via PeopleSoft Zero‑Day (CVE‑2026‑35273)
What Happened — The extortion group ShinyHunters says it exploited an unpatched Oracle PeopleSoft vulnerability (CVE‑2026‑35273) to gain access to the FBI’s job‑application portals on apply.fbijobs.gov and fbijobs.gov/special‑agents. The attackers allege they stole personnel files, medical records, and assignment data for thousands of current, former, and prospective FBI employees and have kept the sites offline.
Why It Matters for Trust & Control Assurance
- Unpatched critical ERP vulnerabilities illustrate the need for continuous control‑assurance programs that monitor patch status and enforce network‑segmentation controls.
- Demonstrable evidence of timely vulnerability remediation and restricted access to sensitive HR systems is a core control objective that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Verisq’s Control Mapping capability can help organizations map patch‑management, network‑segmentation, and logging controls to a unified evidence repository for audit readiness.
Who Is Affected
- Federal law‑enforcement personnel and applicants.
- Any organization that runs Oracle PeopleSoft or similar HR/ERP platforms.
Recommended Actions
- Apply Oracle’s emergency patch for CVE‑2026‑35273 immediately; if patching is delayed, enforce strict network‑level restrictions to the PeopleSoft web tier.
- Review and tighten access controls around HR/ personnel data, ensuring least‑privilege and multi‑factor authentication.
- Verify that logging and monitoring of privileged actions are enabled and that logs are retained for forensic review.
- Conduct a rapid incident‑response assessment to confirm whether data was exfiltrated and to contain any further activity.
Technical Notes – The attack leveraged a zero‑day PeopleSoft flaw first observed in May 2026. Oracle’s advisory recommends emergency patching and, as a temporary mitigation, blocking external traffic to PeopleSoft application servers at the perimeter firewall. ShinyHunters also claims to have accessed FBI‑managed servers in AWS GovCloud, potentially expanding the breach surface. Source: Help Net Security