The 2026 ERP Risk Assessment Report: What 100+ Exposures Reveal About Third-Party Risk and Enterprise ERP Security

Executive Summary

Enterprise resource planning environments were designed to support continuity, consistency, and operational control. Payroll must run. Suppliers must be paid. Student records must remain accurate. Financial reporting must close on time. Workforce administration, procurement, tax workflows, grant management, vendor data, and compliance evidence often depend on systems that sit quietly beneath the visible digital business layer.

The Oracle PeopleSoft zero-day campaign changed the executive interpretation of this hidden dependency. Mandiant and Google Threat Intelligence Group identified an active compromise and extortion campaign attributed to UNC6240, also known as ShinyHunters, targeting Oracle PeopleSoft application infrastructure between May 27, 2026, and June 9, 2026. 

The activity aligned with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability in the Environment Management component with a CVSS 9.8 rating. Google also initiated notifications to more than 100 global organizations whose IP addresses correlated with potentially vulnerable endpoints; most were located in the United States.1 

Oracle confirmed that CVE-2026-35273 affects Oracle PeopleSoft PeopleTools, may affect PeopleSoft Enterprise Applications customers, is remotely exploitable without authentication, and may result in remote code execution after successful exploitation.2 

Oracle’s June 2026 Critical Security Patch Update contained 245 new security patches across product families, including guidance advising PeopleSoft customers to apply the June release because it included the CVE-2026-35273 fix plus additional PeopleSoft updates. 3

This research report examines what those 100+ correlated exposures reveal about enterprise ERP security, third-party risk, privileged access management, compliance readiness, and board-level resilience. The central finding is clear: ERP risk is no longer only an application security issue. It is an enterprise trust issue shaped by asset awareness, privilege, supplier access, detection quality, remediation speed, and the ability to produce evidence while exploitation is active.

CyberTech Intelligence Perspective

CyberTech Intelligence views the PeopleSoft campaign as a signal of ERP security debt. The highest-risk organizations are not necessarily those with the largest application estates. They are the ones that cannot quickly answer where administrative endpoints are exposed, which service identities retain elevated authority, which vendors have standing access, where sensitive exports move, and whether application-layer misuse can be detected before extortion pressure begins.

A mature ERP security program must begin with discovery, ownership, and evidence. Platform replacement may become part of the long-term roadmap, but the immediate priority is control visibility. Enterprises need to prove which assets are exposed, which privileges are justified, which supplier pathways are governed, and which misuse patterns can be detected early enough to prevent operational and reputational damage. 

Why ERP Exposure Has Become a Board-Level Risk Signal

ERP platforms are often discussed as back-office systems, yet their compromise can affect the operational success of an organization. In higher education, these environments may support financial aid, student administration, payroll, research finance, grants, procurement, supplier records, and reporting. In corporate enterprises, parallel systems support workforce administration, revenue operations, finance, supplier management, regulatory documentation, and executive decision-making.

A vulnerable PeopleSoft endpoint, therefore, represents more than an exposed server. It can become a pathway into records, workflows, permissions, integrations, and business evidence. Once those elements are affected, the conversation moves beyond security operations into legal, compliance, procurement, finance, communications, and board oversight.

Google’s analysis showed the campaign was not limited to opportunistic scanning. The attacker staged environments hosted customized MeshCentral agents masquerading as legitimate cloud endpoints, which were used to run administrative command queries and deploy lateral movement and defacement scripts. The campaign also correlated with stolen organization data published on the ShinyHunters data leak site on June 9, 2026. 1

This operational pattern matters because it reflects a chain of business-system exploitation. Attackers sought more than initial access. They inspected configurations, mapped internal paths, moved laterally, staged material, compressed stolen directories, and connected activity to public extortion infrastructure. 1

CyberTech Intelligence Observation

ERP risk becomes board-level when systems of record lose their assumed integrity. The first question after a campaign like this should not be limited to whether a patch was applied. Executives should ask whether the organization can still trust administrative activity, access records, supplier pathways, exports, and recovery evidence.

What 100+ Notifications Reveal About Enterprise Weakness

The notification of more than 100 potentially exposed organizations provides a useful proxy for a wider problem. Many enterprises still struggle to understand which business-critical application components are externally reachable, actively supported, properly segmented, monitored, or governed through clear ownership.

Google reported that some organizations successfully blocked activity or remediated the vulnerability, while others experienced compromise that resulted in stolen data being published on the ShinyHunters leak site. 1 

This split is important. The difference between exposure and business impact often depends on the quality of surrounding controls: network restrictions, privileged access management, log visibility, response speed, and leadership escalation.

Oracle’s June 2026 Critical Security Patch Update also listed 11 PeopleSoft patches, with 7 vulnerabilities remotely exploitable without authentication. 3

This detail reinforces the structural nature of ERP risk. A single zero-day may dominate attention, but enterprise application estates remain exposed to a continuing stream of flaws, configuration weaknesses, unsupported components, and administrative services that may not receive the same scrutiny as cloud workloads.

The PeopleSoft campaign reveals four recurring weaknesses. First, many organizations cannot quickly produce a current map of ERP components, endpoints, integrations, databases, and export destinations. Second, standing privileged access often remains broader than necessary because legacy business systems are difficult to administer without operational shortcuts. 

Third, supplier pathways remain embedded inside daily workflows but are rarely tested during active threat response. Fourth, detection logic often focuses on infrastructure anomalies rather than PeopleSoft, WebLogic, PSEMHUB, PSIGW, outbound Server Message Block traffic, or suspicious administrator behavior.

For enterprise leaders, these findings create a strategic conclusion. ERP exposure is not only a technical defect. It is the result of unresolved operating assumptions.

Higher Education is an Early Warning for Every Sector

Higher education accounted for 68% of the organizations Google notified in relation to potentially vulnerable endpoints. This concentration should not be dismissed as a sector-specific anomaly. Universities and colleges provide an early warning because their environments magnify challenges that also exist across large enterprises. 1 

A university system may serve students, faculty, staff, researchers, applicants, alumni, donors, procurement vendors, financial-aid administrators, health partners, research sponsors, and managed service providers. Its technology estate often reflects decades of customization, decentralized administration, open access expectations, long-lived data retention, and supplier involvement. Those conditions make higher education a useful stress test for ERP security governance.

Corporate environments face similar pressures, even when their operating models appear more centralized. Global manufacturers maintain supplier portals, workforce systems, finance workflows, third-party logistics data, and plant-level integrations. Healthcare organizations manage patient-linked finance, HR, vendor, research, and compliance processes. Financial services firms depend on trusted records across identity, payment, reporting, procurement, and risk systems. Public-sector agencies operate long-retention citizen and workforce records under significant scrutiny.

The lesson is not that higher education is uniquely weak. The lesson is that open, complex, integration-heavy operating models expose ERP blind spots faster. Other sectors should read the 68% concentration as a preview of what can happen when systems of record remain dependent on legacy access paths, unclear ownership, and fragmented control evidence. 1 

Third-Party Risk is Now Embedded Inside ERP Operations

Third-party risk is often discussed as a vendor-management function, but ERP environments show why that framing is incomplete. Suppliers are not only external companies reviewed during procurement. They may be active participants in payroll processing, benefits administration, financial-aid workflows, banking interfaces, procurement networks, analytics platforms, tax systems, managed hosting, identity services, reporting tools, and systems integration.

IBM’s 2026 X-Force Threat Intelligence Index reported that large supply chain and third-party compromises nearly quadrupled since 2020. The same report found a 44% increase in attacks beginning with the exploitation of public-facing applications and stated that vulnerability exploitation accounted for 40% of incidents observed by X-Force in 2025. 4

These figures should reshape ERP supplier governance. A third-party connection into a system of record should be evaluated by current technical reach, not only contractual status. Leaders should know whether a provider can access production systems, export data, administer middleware, maintain service accounts, trigger batch jobs, or connect through persistent credentials.

The PeopleSoft campaign reinforces the need for exposure discovery into supplier access. Attackers used administrative tooling, mapped internal configurations, and relied on credential-based movement techniques.1 In that context, vendor pathways can become part of the blast radius if permissions remain broad, credentials are not rotated, monitoring is weak, or revocation procedures depend on manual coordination.

CyberTech Intelligence Observation

Third-party risk inside ERP environments is rarely visible through questionnaires alone. Effective oversight requires evidence of who can reach what, why access exists, how sessions are logged, when privileges expire, and how fast a provider can be removed during an active incident.

Identity, Privilege, and the Expanding Blast Radius

Identity has become the control plane for ERP resilience. A PeopleSoft vulnerability may open the door, but privileges determine how far an attacker can move once inside. Administrators, database teams, middleware engineers, service accounts, batch scripts, emergency users, cloud operators, integration users, and suppliers may all hold elevated authority over systems carrying sensitive business records.

IBM’s 2026 X-Force Threat Intelligence Index reported that exploitation of public-facing applications accounted for 40% of incidents observed by X-Force in 2025, with attacks exploiting public-facing applications increasing 44% year over year.⁴ For ERP resilience, the implication is direct: exposed business platforms, administrative interfaces, middleware, and supplier-connected systems are now high-value entry points because attackers can move from application exposure into identity abuse, service accounts, privileged pathways, and lateral movement. Similar identity-centered risk patterns are reflected in Palo Alto Networks’ 2026 Unit 42 Global Incident Response Report, which found that identity weaknesses appeared in roughly 90% of investigations, identity-based techniques drove 65% of initial access, and 87% of intrusions involved multiple attack surfaces.⁵ Together, these findings show why PeopleSoft response cannot stop at patching. Institutions need exposure visibility, privileged access governance, service-account control, supplier-access boundaries, endpoint visibility, and board-ready evidence that administrative authority is continuously reviewed. 

These findings align with the ERP risk pattern. A compromise of one administrative endpoint rarely remains neatly contained. Attackers may seek credentials, inspect application configuration files, query internal hosts, access file shares, move through trusted services, reach databases, or interact with third-party tooling. Once these paths open, a single product flaw becomes an enterprise governance problem.

Privileged access management must therefore move beyond vault deployment. Mature programs should include named ownership for elevated roles, just-in-time access, multifactor authentication, session logging, service-account governance, supplier recertification, emergency-account reconciliation, credential rotation, and post-incident review. In systems of record, elevated access should be treated with the same seriousness as financial approval authority because both can affect trust, continuity, and accountability.

Compliance Evidence in the Zero-Day Era

Compliance programs often move on periodic schedules. Zero-day campaigns do not. This mismatch is becoming one of the most important governance weaknesses for enterprises that rely on complex application estates.

Google Cloud’s M-Trends 2026 reported that the mean time to exploit vulnerabilities fell to an estimated seven days, meaning exploitation is increasingly observed before a patch becomes available. 6 

The PeopleSoft timeline reflected this challenge because observed campaign activity began on May 27, 2026, before Oracle’s public advisory on June 10, 2026. 1

For ERP programs, compliance readiness must become continuous evidence rather than retrospective documentation. A policy stating that critical vulnerabilities are patched promptly is not enough during active exploitation. Leaders must be able to show which endpoints were exposed, which compensating controls were activated, which logs were reviewed, which privileged accounts were active, which suppliers retained reach, which exceptions remained open, and which recovery steps were validated.

Deloitte’s The Current: Cybersecurity Forecast for 2026 identifies identity protection, cyber defense, platformization, and resilience as priorities for organizations preparing for the next phase of digital exposure.7 

This direction fits ERP modernization because systems of record require coordinated control across applications, identities, infrastructure, vendors, telemetry, and continuity planning.

CyberTech Intelligence ERP Risk Assessment Framework

A research-led ERP risk assessment should measure exposure, privilege, supplier reach, detection, evidence, and recovery as one connected control system.

This framework is intentionally practical. It does not ask leaders to replace every legacy system at once. It asks whether the organization can see, control, monitor, prove, and restore the systems that matter most.

Google’s remediation guidance aligns with this approach. The company recommended disabling the Environment Management Hub service in multi-server configurations or removing the PSEMHUB application in single-server configurations. 

Where disabling was not feasible, Google advised blocking external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector, reviewing PIA WebLogic logs for external POST /PSEMHUB/hub and POST /PSIGW/HttpListeningConnector activity, checking for unexpected .jsp files under PSEMHUB paths, inspecting unauthorized staging directories, and monitoring outbound SMB traffic from PeopleSoft servers to untrusted destinations. 1

A Practical Roadmap for ERP Risk Reduction: As Per CyberTech Intelligence Research 

The first phase of ERP risk reduction should begin with a 30-day exposure sprint. Security, IT, application owners, finance, HR, procurement, compliance, and legal stakeholders should build one consolidated map of PeopleSoft components, supported versions, externally reachable endpoints, privileged accounts, service identities, vendor pathways, databases, file exports, and recovery dependencies. Oracle June 2026 update status should be confirmed during this phase because the release included the CVE-2026-35273 fix and additional PeopleSoft updates. 3

The second 30-day phase should focus on control tightening. Organizations should restrict administrative endpoints, isolate unnecessary external reachability, rotate elevated credentials, remove dormant users, vault service secrets, narrow vendor permissions, enforce multifactor authentication, review WebLogic access logs, inspect web-tier file systems, and monitor outbound SMB traffic from PeopleSoft hosts.

The final 30-day phase should institutionalize evidence. Leadership should receive an ERP risk pack that includes inventory, patch status, emergency-change records, access-review results, supplier attestations, detection coverage, incident-response procedures, backup validation, tabletop results, open exceptions, accountable owners, and target completion dates.

This roadmap is deliberately staged. A rushed response can create operational instability in sensitive environments. A slow response can leave systems exposed. The goal is disciplined urgency: reduce the most dangerous pathways first while building evidence that can withstand board, audit, regulator, insurer, and customer review.

Enterprise Trust After the PeopleSoft Campaign

The Oracle PeopleSoft zero-day should change how executives describe systems of record. ERP platforms are not passive databases behind the perimeter. They are an active trust infrastructure. They define who gets paid, which students receive aid, which suppliers are approved, which records support audits, which reports guide leadership, and which workflows sustain operations.

A mature response does not depend on overconfident messaging. It depends on documented preparation. Executive teams should know whether critical business systems are mapped, which sensitive records move through those systems, which administrators hold elevated permissions, which suppliers retain access, which detections are active, and whether trusted operations can be restored after compromise.

Organizations best positioned for the next ERP campaign will not simply patch faster. They will know where exposure exists, how privileges are governed, how supplier reach is controlled, how abnormal activity is investigated, and how evidence can be produced while pressure is rising.

Conclusion

The 100+ Oracle PeopleSoft exposures identified by Google and Mandiant reveal a broader enterprise risk pattern. Systems of record remain deeply connected, highly privileged, supplier-dependent, and operationally sensitive. Attackers understand this value. Boards need the same clarity.

ERP security must now be assessed as an enterprise resilience discipline. The strongest programs will combine exposure visibility, privileged access management, third-party governance, application-aware detection, continuous compliance evidence, and recovery validation. Patching remains necessary, but it is only one control in a larger operating model.

The practical next step is not immediate platform replacement. It is evidence. Enterprises should begin by identifying exposed components, reviewing elevated permissions, validating supplier pathways, deploying PeopleSoft-aware monitoring, and building board-ready proof that critical systems can be governed under active threat conditions.

For U.S. enterprises, the strategic lesson is direct. ERP risk has moved from the application backlog to the executive agenda. Systems carrying payroll, finance, student, workforce, supplier, and regulatory data deserve the same urgency already applied to cloud, identity, endpoint, and customer-facing infrastructure.

About CyberTech Intelligence

CyberTech Intelligence helps enterprise technology, cybersecurity, and go-to-market leaders translate complex market shifts into research-led narratives, buyer-focused content, and strategic demand programs. Its work supports organizations operating across cybersecurity modernization, compliance-driven messaging, cyber resilience, identity protection, ERP security, privileged access management, third-party risk, and enterprise technology growth.

For teams developing initiatives around Oracle PeopleSoft security, ERP risk assessment, privileged access management, compliance readiness, vulnerability management, third-party risk, threat intelligence, or incident response, CyberTech Intelligence can help shape technical urgency into clear enterprise messaging.

Contact Us Today

References

1. Google Cloud Mandiant, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, June 2026
   https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
2. Oracle, Oracle Security Alert Advisory - CVE-2026-35273, June 2026
   https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
3. Oracle, Critical Security Patch Update Advisory - June 2026, June 2026
   https://www.oracle.com/security-alerts/cspujun2026.html
4. IBM, IBM 2026 X-Force Threat Intelligence Index: AI-Driven Attacks Are Escalating as Basic Security Gaps Leave Enterprises Exposed, February 25, 2026
   https://newsroom.ibm.com/2026-02-25-ibm-2026-x-force-threat-index-ai-driven-attacks-are-escalating-as-basic-security-gaps-leave-enterprises-exposed
5. Palo Alto Networks Unit 42, 2026 Unit 42 Global Incident Response Report, February 2026
   https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
6. Google Cloud Mandiant, M-Trends 2026, March 2026
   https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/
7. Deloitte, The Current: Cybersecurity Forecast for 2026, 2026
   https://www.deloitte.com/us/en/services/consulting/articles/cybersecurity-forecast-for-2026.html