CVE-2026-35273: Critical unauthenticated RCE risk in Oracle PeopleSoft PeopleTools

Oracle has published a Security Alert for CVE-2026-35273 affecting PeopleSoft Enterprise PeopleTools. The issue is remotely exploitable without authentication over HTTP and may result in remote code execution. Oracle rates the flaw at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and urges immediate mitigation. Versions 8.61 and 8.62 of PeopleTools are confirmed affected. Oracle also notes that PeopleSoft Enterprise Applications customers may be impacted and recommends prompt action.

BleepingComputer reports that this vulnerability aligns with a PeopleSoft zero‑day used in recent data theft activity attributed to the ShinyHunters group, and cites a public statement from Mandiant’s CTO confirming active exploitation. Oracle’s advisory does not provide exploitation details but does provide mitigations and implementation guidance.

What we know

According to Oracle’s advisory, CVE-2026-35273 is a vulnerability in the PeopleSoft Enterprise PeopleTools “Updates Environment Management” component. It is exploitable without authentication via HTTP and may lead to remote code execution and full compromise of PeopleTools. Oracle has released mitigation guidance through its Security Alert program and recommends immediate implementation. The advisory specifies:

• Affected product: PeopleSoft Enterprise PeopleTools (component: Updates Environment Management)
• Affected versions: 8.61 and 8.62
• Impact: Potential takeover of PeopleTools; RCE possible
• Severity: CVSS 3.1 Base Score 9.8 (C/I/A: High)

Oracle emphasizes that mitigations and patches in the Security Alert program are available for supported product versions. It also states that earlier releases may be affected but are not tested; upgrading to supported versions is recommended.

Separately, BleepingComputer reports that ShinyHunters claims involvement in breaches leveraging a PeopleSoft zero‑day and states that Mandiant’s CTO publicly confirmed CVE-2026-35273 is being actively exploited. BleepingComputer further notes that researchers shared IP addresses observed in related activity and recommends reviewing logs against those indicators. Oracle’s advisory does not include these indicators.

Why it matters

PeopleSoft powers critical HR, finance, and operations workflows across many enterprises. A network‑exposed, unauthenticated path to potential remote code execution presents a high‑impact risk to confidentiality, integrity, and availability. When HTTP is listed in Oracle risk matrices, secure variants like HTTPS are also considered in scope, broadening the potential exposure for internet‑facing or internally accessible deployments.

Practical next steps

• Review and implement Oracle’s Security Alert guidance for CVE-2026-35273 without delay: https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
• Confirm whether your environment runs PeopleTools 8.61 or 8.62 and assess any PeopleSoft Enterprise Applications that may also be affected.
• Ensure you are on supported product versions so Security Alert mitigations and future fixes are available; plan upgrades if needed per Oracle’s support policy.
• Monitor Oracle’s advisory for updates and patch availability.
• If you track potential exposure, BleepingComputer’s report includes externally shared indicators tied to recent activity; consider reviewing logs for connections associated with those indicators: https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/

What’s still unclear

Oracle has not disclosed detailed technical mechanics of the flaw beyond the affected component and conditions for exploitation. While BleepingComputer reports active exploitation linked to ShinyHunters and cites a confirmation from Mandiant’s CTO, Oracle’s advisory does not provide incident specifics. The extent of impacted organizations and environments remains uncertain in public sources.

Bottom line

CVE-2026-35273 is a critical, unauthenticated issue in Oracle PeopleSoft PeopleTools with a clear path to severe impact. Organizations running affected versions should prioritize Oracle’s mitigations now, verify product support status, and keep watch for advisory updates. Given reports of active exploitation, timely action meaningfully reduces risk while longer‑term fixes progress through the Security Alert program.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.