# CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft

PSIGW HttpListeningConnector SSRF reaches loopback-only PSEMHUB, whose ExecuteProcessActivityCommand writes arbitrary files and XMLDecoder deserializes attacker XML, yielding RCE.

- Payout: Real-world hack
- Severity: critical
- Program: Oracle
- Analysis by: @thezdi
- Disclosed: 2026-10-27
- CVE: CVE-2026-35273
- Write-up quality: 9/10
- Original: https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft
- Library page: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:research sev:critical tech:java technique:chained technique:source-review vuln:access-control vuln:deserialization vuln:rce vuln:ssrf

**Target:** PeopleSoft Environment Management Hub (PSEMHUB) and Integration Gateway (PSIGW) WebLogic apps
**Root cause:** HttpTargetConnector forwards attacker-controlled URL and body with no target validation, and validateClient trusts localhost by default; PSEMHUB then writes attacker-controlled content to arbitrary absolute paths and XMLDecoder-deserializes XML from a writable directory.
**Steps:**
1. POST to `/PSIGW/HttpListeningConnector` with the HttpTargetConnector handler specified
2. Set target URL to `http://127.0.0.1:8000` so the request originates from localhost and satisfies validateClient
3. Place the full inner POST request (form-encoded serialized Java objects) in the `Data` field to be forwarded as-is
4. Inner request to PSEMHUB routing hub calls ExecuteProcessActivityCommand with web shell contents in `m_line` and absolute path in `m_targetFile`
5. Write JSP shell into the PSEMHUB WAR path for immediate RCE, or write malicious XML into `[docroot]/envmetadata/data/environment/` for XMLDecoder deserialization on HubServlet init
**How found:** Investigated PSEMHUB's validateClient protection and noticed localhost is in the default allowedhosts.properties; then reviewed the 800+-line HttpTargetConnector handler and found no validation of target URL or payload, letting the SSRF satisfy the localhost check.
**Exploitation:** Attacker with low-privileged access uses PSIGW SSRF to send requests from localhost, bypassing validateClient's default localhost allowlist, then reaches PSEMHUB endpoints to write a JSP web shell into the WAR (immediate RCE as the PeopleSoft service account) or plant XML that XMLDecoder deserializes on restart.
**Escalation:** SSRF (foothold) -> loopback access to internal PSEMHUB -> arbitrary file write -> JSP web shell RCE, or stealthier XMLDecoder deserialization RCE on service restart.
**Insight:** When an internal service's access control allowlists localhost by default, hunt for any SSRF primitive in a sibling app on the same host — the SSRF becomes an auth bypass into the protected service; also check file-write handlers for absolute-path parameters and XMLDecoder on writable config directories.

## Write-ups of the same bug (oldest first)
- 2026-10-27: [CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) — Bobby Gould
- 2026-10-27: [CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft) — @thezdi (this one)