CVE-2026-35273

CVE-2026-35273 is a missing-authentication flaw (CWE-306) in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported releases 8.61 and 8.62. An unauthenticated attacker with network access over HTTP can reach the vulnerable component with no credentials and no user interaction, and successful attacks result in full takeover of the PeopleTools environment — reported in the wild as remote code execution followed by data theft. Organizations running PeopleSoft — including universities, government agencies and large enterprises — are affected, and the ShinyHunters group has already used the flaw against unpatched universities, with Nissan disclosing an employee-data breach linked to it. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-12 with ransomware use noted, and EPSS assigns a 95.5% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but exploitation is confirmed in the wild, having been used as a zero-day before patching.

What to do: Apply the PeopleTools security fixes for releases 8.61 and 8.62 per Oracle's advisory instructions immediately, prioritizing internet-facing instances to meet CISA KEV/BOD 26-04 timelines; where patching is not yet possible, restrict HTTP access to the PeopleSoft tier from untrusted networks. Review web and application logs on 8.61/8.62 environments for signs of unauthenticated access to the Updates Environment Management component, given confirmed ShinyHunters exploitation and ransomware use. Organizations unable to mitigate internet exposure should follow BOD 26-04 guidance for cloud services or consider discontinuing use of the exposed product.