Daily Threat Briefing
← All briefings

Oracle PeopleSoft · Ivanti Sentry · 389-ds-base

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-12 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

The dominant new development today is the confirmed exploitation of a zero-day in Oracle PeopleSoft (CVE-2026-35273) by the ShinyHunters group (tracked as UNC6240 by Mandiant), with universities and enterprise organizations breached between May 27 and June 9 before Oracle published its advisory. CISA has added Ivanti Sentry CVE-2026-10520 to the KEV catalog with a June 14 remediation deadline, confirming active exploitation risk. A new Windows BitLocker bypass (GreatXML) has been publicly released by the same researcher who published the RoguePlanet Defender exploit the previous day. The Gentlemen ransomware group has been profiled as a worm-capable operation with 478 claimed victims.

CRITICAL VULNERABILITIES

CVE-2026-35273 (Oracle PeopleSoft)

  • Affected products: Oracle PeopleSoft (exact version range not yet fully disclosed by Oracle)
  • Severity: Not yet formally scored; exploited as a zero-day prior to patch availability
  • Exploitation status: Actively exploited in the wild; Mandiant attributes campaign to UNC6240 (ShinyHunters), May 27 to June 9, 2026
  • Technical detail: An unpatched flaw in Oracle PeopleSoft was exploited to gain unauthorized access to enterprise systems and exfiltrate data. Oracle published its advisory on June 10, meaning the vulnerability was exploited as a zero-day for approximately two weeks. Universities and higher-education institutions were the primary targets, though enterprise deployments are also at risk. BSI advisory WID-SEC-2026-1881 (Oracle PeopleSoft) was published June 11 and covers this item.
  • Remediation: Apply Oracle’s June 10 advisory patch immediately. Audit PeopleSoft access logs for activity between May 27 and June 9. Treat any anomalous authentication or data access during that window as a potential indicator of compromise. Engage incident response if suspicious activity is found.

CVE-2026-10520 (Ivanti Sentry)

  • STATUS CHANGE: Added to CISA KEV on 2026-06-11 with a mandatory remediation deadline of 2026-06-14 for US federal agencies; confirms active exploitation risk.
  • Affected products: Ivanti Sentry (formerly MobileIron Sentry), all versions per vendor advisory
  • Severity: Critical; unauthenticated OS command injection enabling root-level RCE (CWE-78)
  • Exploitation status: CISA KEV listed; exploitation confirmed or assessed as imminent
  • Remediation: Apply Ivanti patches per the vendor advisory immediately. The June 14 deadline is binding for US federal entities; European organizations should treat this with equivalent urgency. Ensure mTLS with EPMM or restrict HTTPS access via Neurons for MDM to limit external exposure. Reference: CISA KEV, BSI WID-SEC-2026-1841.

CVE-2026-11774 (Red Hat 389 Directory Server / FreeIPA)

  • Affected products: 389-ds-base (Red Hat Directory Server, FreeIPA, Red Hat Identity Management); all versions with SASL I/O layer prior to fix
  • Severity: High (CVSS 7.6); potential for DoS or RCE
  • Exploitation status: No confirmed exploitation; published 2026-06-11
  • Technical detail: An integer overflow in sasl_io_start_packet() causes unsigned wraparound when a crafted SASL packet length prefix of 0xFFFFFFFC has sizeof(uint32_t) added, bypassing the nsslapd-maxsasliosize limit and producing a heap buffer overflow of up to approximately 2 MB of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this remotely. Impact ranges from DoS to potential RCE. This is distinct from CVE-2025-14905.
  • Remediation: Apply Red Hat security updates for 389-ds-base. Prioritize FreeIPA and Red Hat Identity Management deployments. Restrict LDAP/SASL access to trusted hosts where possible.

CVE-2026-10795 (WordPress UpdraftPlus Plugin)

  • Affected products: UpdraftPlus: WP Backup and Migration Plugin, all versions up to and including 1.26.4
  • Severity: High (CVSS 8.1)
  • Exploitation status: No confirmed exploitation; published 2026-06-11
  • Technical detail: Insufficient validation of the remote communications message format in UpdraftPlus_Remote_Communications_V2::wp_loaded allows unauthenticated attackers to bypass signature verification. Unchecked decryption return values collapse to a predictable all-zero encryption key, enabling forgery of arbitrary RPC commands executed as the connected administrator. This can result in malicious plugin upload and activation, leading to full site RCE. UpdraftPlus is one of the most widely deployed WordPress backup plugins globally.
  • Remediation: Update UpdraftPlus to version 1.26.5 or later immediately. Audit WordPress sites for unauthorized plugin installations or administrator account changes.

CVE-2026-8589 (GitLab EE/CE)

  • Affected products: GitLab EE and CE, versions 13.1.4 through 18.10.7, 18.11.0 through 18.11.4, 19.0.0 through 19.0.1
  • Severity: High (CVSS 8.7 per NVD)
  • Exploitation status: No confirmed exploitation; patched in 18.10.8, 18.11.5, 19.0.2
  • Technical detail: Improper sanitization of user-supplied input in certain group setting fields allows an authenticated attacker to add unauthorized email addresses to a targeted user’s account, enabling account takeover. BSI advisory WID-SEC-2026-1886 covers this and additional GitLab vulnerabilities.
  • Remediation: Upgrade GitLab to 18.10.8, 18.11.5, or 19.0.2. Self-hosted GitLab operators should prioritize this update given the account takeover potential.

ONGOING

  • CVE-2026-IVANTI-SENTRY / CVE-2026-10523 (Ivanti Sentry): KEV deadline 2026-06-14; patch immediately. (See full entry above.)
  • CVE-2026-5027 (Langflow): Actively exploited unpatched path traversal; isolate from internet, BSI WID-SEC-2026-0900 still flagged UNGEPATCHT.
  • CVE-2026-20253 / CVE-2026-20251 (Splunk Enterprise/Cloud/Secure Gateway): Critical and high-severity; apply SVD-2026-0603 and SVD-2026-0601 patches.
  • CVE-2026-NETLOGON (Windows Netlogon): Actively exploited; apply June 2026 Patch Tuesday to all domain controllers.
  • CVE-2026-50751 (Check Point Security Gateway): Actively exploited; CISA deadline passed, apply hotfix sk185033 immediately.
  • CVE-2026-11645 (Google Chrome V8): Actively exploited; update to 149.0.7827.103 or later.
  • CVE-2026-42271 (BerriAI LiteLLM): Actively exploited; CISA deadline 2026-06-22, upgrade to v1.83.7-stable.
  • Microsoft Defender RoguePlanet zero-day: Public PoC available; no patch; monitor for anomalous SYSTEM-level process spawning.

EUROPEAN ADVISORIES

BSI CERT-Bund published a high volume of advisory updates on 2026-06-11. New advisories of note are consolidated below. Items already covered in Critical Vulnerabilities are cross-referenced only.

WID-SEC-2026-1841 (Ivanti Sentry): covered in Critical Vulnerabilities.

WID-SEC-2026-1881 (Oracle PeopleSoft): covered in Critical Vulnerabilities.

WID-SEC-2026-1888 (NEW - Apache OFBiz): BSI published a new high-severity advisory for Apache OFBiz. An authenticated remote attacker can exploit multiple vulnerabilities to escalate privileges or execute arbitrary code. Organizations running Apache OFBiz ERP should apply available security updates immediately; OFBiz has a history of critical exploitation in enterprise environments.

WID-SEC-2026-1886 (NEW - GitLab): BSI published a new high-severity advisory for GitLab covering multiple vulnerabilities including security bypass, data manipulation, SSRF, XSS, information disclosure, and denial of service. Includes CVE-2026-8589 (see Critical Vulnerabilities). Apply GitLab patches 18.10.8, 18.11.5, or 19.0.2.

WID-SEC-2026-1884 (NEW - Jenkins): BSI published a new high-severity advisory for Jenkins covering multiple vulnerabilities enabling arbitrary code execution, user impersonation, open redirect, security bypass, data disclosure and manipulation, and XSS. Organizations using Jenkins CI/CD pipelines should apply the latest Jenkins security updates and review plugin versions.

WID-SEC-2026-1877 (NEW - Splunk Enterprise): BSI published a new high-severity advisory for Splunk Enterprise covering code execution, XSS, data manipulation, security bypass, and information disclosure. Apply Splunk patches per SVD-2026-0601 and SVD-2026-0603.

WID-SEC-2026-1875 (NEW - n8n): BSI published a new high-severity advisory for n8n workflow automation platform covering code execution, security bypass, SQL injection, XSS, data manipulation, DoS, and information disclosure, with potential for privilege escalation. Organizations using n8n in automation pipelines should apply available updates and restrict network exposure.

WID-SEC-2026-1880 (NEW - cPanel/WHM): BSI published a new high-severity advisory for cPanel and WHM covering potential code execution, security bypass, DoS, data manipulation and disclosure. Apply cPanel security updates.

WID-SEC-2026-1879 (NEW - Palo Alto Cortex XSOAR / Commvault SecurityIQ Marketplace): BSI published a new high-severity advisory covering security bypass and data manipulation vulnerabilities. Apply vendor patches.

WID-SEC-2026-1872 (NEW - Ubiquiti UniFi OS): BSI published a new high-severity advisory for Ubiquiti UniFi OS covering code execution, information disclosure, privilege escalation, access control bypass, and data manipulation. Relevant for organizations using UniFi network infrastructure. Apply firmware updates.

BSI update advisories for Mozilla Firefox/Thunderbird, Linux Kernel, Bouncy Castle BC-JAVA, Apache HTTP Server, OpenSSL, Golang, Keycloak, Samba, and other components reflect ongoing maintenance updates with no new material exploitation developments.

ACTIVE THREATS AND CAMPAIGNS

ShinyHunters / UNC6240 - Oracle PeopleSoft Zero-Day Campaign (NEW) Mandiant attributes a data theft and extortion campaign to UNC6240, the group publicly known as ShinyHunters. The campaign exploited CVE-2026-35273 in Oracle PeopleSoft as a zero-day between May 27 and June 9, 2026, before Oracle published its advisory on June 10. Universities were the primary targets, though any internet-facing PeopleSoft deployment should be considered at risk. The group exfiltrated data and demanded payment to suppress publication. Organizations should immediately patch PeopleSoft, audit logs for the relevant window, and treat any anomalous access as a potential breach indicator.

The Gentlemen Ransomware (NEW) A new analysis reveals The Gentlemen as a financially motivated double-extortion group claiming 478 victims. The group operated as a RaaS affiliate leveraging LockBit, Qilin, and Medusa infrastructure before developing worm-capable propagation functionality. The worm component significantly increases lateral movement risk within enterprise networks. No specific IOCs published in available reporting at time of writing; monitor for lateral movement patterns consistent with RaaS-style intrusions.

OpenClaw AI Agent - Prompt Injection and Code Execution Research (NEW) Separate research from Imperva and Varonis demonstrates that OpenClaw, a widely deployed self-hosted AI agent, can be manipulated via prompt injection embedded in shared contacts, vCards, and location pins to execute attacker-controlled code or exfiltrate sensitive data without user awareness. Multiple CVEs have been published (CVE-2026-53806 through CVE-2026-53819) covering shell option bypass, authorization bypass, privilege escalation, SSRF, and code execution. Organizations deploying OpenClaw should update to the latest patched versions and restrict agent access to sensitive data and systems.

OceanLotus / APT32 - SPECTRALVIPER Campaign (ONGOING) OceanLotus attributed to ongoing espionage targeting Vietnamese infrastructure and supply chain entities using SPECTRALVIPER backdoor; no new European relevance reported.

SECURITY NEWS AND CONTEXT

GreatXML BitLocker Bypass: Researcher Chaotic Eclipse published a new Windows BitLocker bypass technique dubbed GreatXML, exploiting XML files in the Windows recovery partition. This follows the RoguePlanet Defender exploit released the previous day by the same researcher; no CVE or patch is currently available.

GitHub npm Supply Chain Hardening: GitHub announced that npm version 12 will disable install scripts by default, a significant change aimed at blocking a common supply chain attack vector where malicious lifecycle hooks execute code during package installation. Organizations should review npm pipeline configurations ahead of this change.

RECOMMENDED ACTIONS

  1. Apply Ivanti Sentry patches immediately; CISA KEV deadline is 2026-06-14. Verify mTLS or restricted HTTPS access is enforced.
  2. Patch Oracle PeopleSoft per the June 10 advisory and audit access logs for May 27 to June 9 for signs of UNC6240 intrusion activity.
  3. Update UpdraftPlus WordPress plugin to 1.26.5 or later on all managed WordPress instances; audit for unauthorized admin accounts or plugin installations.
  4. Apply Red Hat / FreeIPA updates for CVE-2026-11774 (389-ds-base); restrict LDAP/SASL access to trusted hosts.
  5. Upgrade GitLab to 18.10.8, 18.11.5, or 19.0.2 to address CVE-2026-8589 and related issues.
  6. Apply BSI-flagged patches for Jenkins, Apache OFBiz, n8n, Splunk Enterprise, cPanel/WHM, and Ubiquiti UniFi OS.
  7. Update OpenClaw AI agent deployments to latest patched versions; restrict agent permissions to least-privilege.
  8. Assess BitLocker configurations and recovery partition access controls in light of the GreatXML disclosure; no patch available, apply defense-in-depth.
  9. Review npm pipeline configurations in preparation for npm v12 install script changes.
  10. Continue remediation of previously reported items: Langflow CVE-2026-5027 (isolate immediately), Splunk SVD-2026-0603/0601, Windows Netlogon RCE, Check Point CVE-2026-50751, Chrome CVE-2026-11645, LiteLLM CVE-2026-42271, and June 2026 Patch Tuesday items.