Contractor's missed PeopleSoft patch let attackers into FBI employee data

SC World's account, drawn from an Information Week report, is a single paragraph ^[1]. It does not give the date Oracle shipped the fix, when the intrusion began, the contractor's name, what employee data was taken, or a severity rating beyond "critical" ^[2]. For ranking CVE-2026-35273 against the rest of the patch queue, exploitation settles it: threat actors including ShinyHunters have used the flaw, the brief says ^[4].

Compensating controls are a weak substitute here. The attackers modified their methods to bypass existing security measures, according to the same report ^[4]. We think the patch is the only control to count for this CVE. ShinyHunters is named as one of several actors working the flaw ^[4]. Several groups on one bug, with at least one of them adapting to defences, fits a campaign against PeopleSoft customers in general, and on this evidence we would not treat the FBI as a singled-out target.

The failure point was who owned the job. The platform was managed by a third party ^[1], and the contractor did not apply the patch ^[2]. SC World describes the challenge as "ensuring timely patching when responsibility is distributed across multiple external entities" ^[8]. In our view the gap is visibility. An owner's patch reporting covers the systems the owner patches. A PeopleSoft instance run by a contractor stays outside that report unless the contract obliges the operator to produce the installed patch level from the running system. SC World's headline says the FBI's contractor was removed ^[9].

The wider figures point the same way. Verizon's 2026 Data Breach Investigations Report finds vulnerability exploitation is now the leading initial access vector for breaches, according to the brief ^[5]. The same report says AI is shortening the time from disclosure to exploitation ^[6]. We'd expect a fix routed through a contractor's change process to land later than one the owner applies directly, and that delay now falls inside a shorter window ^[6]. The brief also cites a 60% rise in breaches involving third parties ^[7].