Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026

CVE-2026-35273 is a missing-authentication flaw (CWE-306) in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported releases 8.61 and 8.62. An unauthenticated attacker with network access over HTTP can reach the vulnerable component with no credentials and no user interaction, and successful attacks result in full takeover of the PeopleTools environment — reported in the wild as remote code execution followed by data theft. Organizations running PeopleSoft — including universities, government agencies and large enterprises — are affected, and the ShinyHunters group has already used the flaw against unpatched universities, with Nissan disclosing an employee-data breach linked to it. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-12 with ransomware use noted, and EPSS assigns a 95.5% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but exploitation is confirmed in the wild, having been used as a zero-day before patching.

Do: Apply the PeopleTools security fixes for releases 8.61 and 8.62 per Oracle's advisory instructions immediately, prioritizing internet-facing instances to meet CISA KEV/BOD 26-04 timelines; where patching is not yet possible, restrict HTTP access to the PeopleSoft tier from untrusted networks. Review web and application logs on 8.61/8.62 environments for signs of unauthenticated access to the Updates Environment Management component, given confirmed ShinyHunters exploitation and ransomware use. Organizations unable to mitigate internet exposure should follow BOD 26-04 guidance for cloud services or consider discontinuing use of the exposed product.

Oracle E-Business Suite contains a critical improper privilege management flaw (CVE-2026-46817) in the File Transmission component of Oracle Payments, affecting versions 12.2.3 through 12.2.15. The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger it, with no credentials or user interaction required. Successful exploitation results in takeover of Oracle Payments, with high confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Organizations running the affected E-Business Suite releases — especially those exposing the Payments/File Transmission interface to untrusted networks — are in scope. The issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-15, researchers have observed exploitation in the wild, and EPSS assigns a 13% probability of exploitation within 30 days (96th percentile).

Do: Apply the remediation provided in Oracle's security advisory for CVE-2026-46817 to all Oracle E-Business Suite 12.2.3–12.2.15 environments running Oracle Payments, and in the meantime restrict HTTP/network access to the File Transmission component. Because the flaw is being actively exploited, review EBS/Payments access logs for unauthenticated requests and anomalous file-transmission activity to check for compromise. Federal agencies must apply mitigations in line with CISA BOD 26-04 timelines or discontinue use of the product if mitigations are unavailable.