# CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft

PSIGW HttpListeningConnector SSRF reaches loopback-only PSEMHUB, whose ExecuteProcessActivityCommand writes arbitrary files and XMLDecoder deserializes attacker XML, yielding RCE.

- Payout: Real-world hack
- Severity: critical
- Program: Oracle
- Analysis by: Bobby Gould
- Disclosed: 2026-10-27
- CVE: CVE-2026-35273
- Write-up quality: 9/10
- Original: https://www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft
- Library page: https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:research sev:critical tech:java technique:chained technique:source-review vuln:access-control vuln:deserialization vuln:rce vuln:ssrf

**Target:** PeopleSoft Environment Management Hub (PSEMHUB) and Integration Gateway (PSIGW) WebLogic apps
**Root cause:** HttpTargetConnector forwards attacker-controlled URL and body with no target validation, and validateClient trusts localhost by default; PSEMHUB then writes attacker-controlled content to arbitrary absolute paths and XMLDecoder-deserializes files from envmetadata/data/environment.
**Steps:**
1. POST to `/PSIGW/HttpListeningConnector` specifying the HttpTargetConnector handler class
2. Set target URL to `http://127.0.0.1:8000` (loopback satisfies validateClient's default allowedhosts.properties localhost entry)
3. Place full POST body in the `Data` field; HttpTargetConnector sends it as-is to the target
4. Via SSRF, call PSEMHUB ExecuteProcessActivityCommand with `m_line` = JSP web shell contents and `m_targetFile` = absolute path inside PSEMHUB WAR
5. Alternatively write malicious XML into `[docroot]/envmetadata/data/environment/`; on HubServlet init, startServerPeer -> HubMBeanPersistance loads files and XMLDecoder deserializes them
**How found:** Investigated validateClient's allowlist logic and noticed localhost is trusted by default; combined with PSIGW's unvalidated HttpTargetConnector URL/body forwarding, realized SSRF could satisfy the check and reach PSEMHUB, then reviewed ExecuteProcessActivityCommand and HubServlet init for file write and deserialization sinks.
**Exploitation:** Attacker with low-privileged access uses PSIGW SSRF to reach loopback-only PSEMHUB, then either writes a JSP shell into the WAR for immediate RCE as the PeopleSoft service account, or plants XML that XMLDecoder deserializes on restart for stealthier execution.
**Escalation:** SSRF (foothold) -> bypass validateClient via localhost -> arbitrary file write -> JSP web shell RCE, or XML deserialization RCE on service restart.
**Insight:** When an internal service gates access via a client-IP allowlist that includes localhost, hunt for any SSRF primitive in a sibling app on the same host — the SSRF becomes a full auth bypass into the protected management interface.

## Write-ups of the same bug (oldest first)
- 2026-10-27: [CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) — Bobby Gould (this one)
- 2026-10-27: [CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) — @thezdi