CVE-2026-35273: Oracle PeopleSoft PeopleTools missing authentication allows takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable full takeover with a 9.8 CVSS score, active KEV listing with ransomware use, and near-certain EPSS exploitation probability.

What it is

Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component) in versions 8.61 and 8.62 is missing authentication for a critical function, allowing an unauthenticated network attacker to compromise the product. Successful exploitation results in full takeover of the affected PeopleSoft Enterprise PeopleTools instance.

Impact

An attacker gains complete control of the affected PeopleSoft Enterprise PeopleTools system, with high confidentiality, integrity and availability impact, including potential data theft, tampering and service disruption.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed PeopleSoft Enterprise PeopleTools 8.61 or 8.62 endpoint running the Updates Environment Management component is in scope.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-06-12 with known ransomware campaign use, and EPSS gives a 30-day exploitation probability of 0.95473 (99.867th percentile), indicating active exploitation.

What to do

• Apply the Oracle security alert patch for CVE-2026-35273 to PeopleSoft Enterprise PeopleTools 8.61 and 8.62 immediately, per CISA's 2026-06-15 due date.
• If patching is not immediately possible, restrict network access to the Updates Environment Management component and remove internet exposure of affected PeopleSoft endpoints.
• Follow CISA BOD 26-04 guidance for cloud-hosted instances, or discontinue use of the product where mitigations are unavailable.
• Assume compromise on any exposed, unpatched instance and perform forensic triage per CISA requirements before returning it to service.

Detection

• Review HTTP access logs for unauthenticated requests to PeopleSoft Enterprise PeopleTools Updates Environment Management endpoints, especially from unfamiliar source IPs.
• Hunt for post-exploitation activity on PeopleSoft hosts such as new administrative accounts, unexpected configuration changes, or outbound connections to unknown hosts.
• Correlate endpoint and network telemetry for indicators of ransomware staging or lateral movement on systems hosting PeopleSoft Enterprise PeopleTools.
• Audit PeopleSoft application and web server logs for anomalous administrative actions occurring outside normal change windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.