Mandiant reported ShinyHunters exploiting CVE-2026-35273, a vulnerability discovered by TrendAI. TrendAI investigated three distinct vulnerabilities in PeopleSoft components, not just the single CVE Oracle initially assigned. This report details these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) in the PeopleSoft Integration Gateway (PSIGW). This SSRF allows attackers to bypass PeopleSoft's validateClient method, which is meant to restrict access to sensitive functionality. The PeopleSoft Environment Management Hub (PSEMHUB) implements this validateClient method, but the SSRF allows attackers to target it via the loopback interface.The first bug leverages the PSIGW SSRF to enable attackers to craft requests to internal PeopleSoft components. By controlling the URL and payload, attackers can effectively proxy requests. This SSRF is crucial because the validateClient method permits access from localhost by default. The second vulnerability, an External Control of File Path in PSEMHUB, allows an attacker to write arbitrary content to any file on the server. By combining the SSRF with this file write vulnerability, an attacker can write a web shell to the PSEMHUB WAR path, achieving remote code execution. The third vulnerability is a Deserialization of Untrusted Data in PSEMHUB. Attackers can place a malicious XML file in a specific directory, which is then deserialized by PSEMHUB upon startup or service restart, leading to code execution. These chained vulnerabilities allow complete compromise of affected PeopleSoft instances.