CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools: Missing Authentication | CVSS 9.8 CRITICAL

CRITICAL

CVSS 9.8 CRITICAL  ·  EPSS 0%  ·  Oracle  PeopleSoft Enterprise PeopleTools

Severity Overview

Summary

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

What the Attack Looks Like

How it works: A function that should require authentication is reachable without any, granting direct unauthenticated access to sensitive operations or administrative capabilities.

If successfully exploited: A successful exploit gives the attacker a foothold on the target system with access to sensitive data and the ability to deploy secondary payloads. Full confidentiality and integrity impact means an attacker can both read and modify sensitive data — useful for credential harvesting, data theft, or manipulating application state. High availability impact means the vulnerability can also cause a denial of service, which may be used for disruption or as a diversion during a broader attack. CISA has confirmed known ransomware campaign use for this CVE. This is not a theoretical risk — organizations with unpatched systems should treat this as an active incident response scenario, not just a patch management item.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and no authentication is required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. CISA indicates known ransomware campaign use, which raises the likelihood of rapid operational impact if vulnerable systems remain exposed. Oracle PeopleSoft Enterprise PeopleTools is associated with technology that is commonly deployed in enterprise environments, so defenders should assume a higher probability of broad target interest and prioritize validation across the environment. The ATT&CK mapping suggests public-facing exploitation risk, so external exposure validation should be part of immediate triage. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

MITRE ATT&CK Mapping

• T1190 – Exploit Public-Facing Application
  Rationale: The product appears likely to be internet-facing or commonly exposed in enterprise environments.

Detection Guidance

• CWE-306 — Missing Authentication for Critical Function
  • Unauthenticated access to sensitive endpoints: Search access logs for requests to admin, management, or configuration endpoints that carry no authentication headers or session tokens. These requests should be rare to nonexistent in a properly configured deployment.
  • Source IP analysis: Flag access to management interfaces from external IPs or IPs outside your admin network range. The absence of authentication makes these endpoints especially attractive for opportunistic attackers.
  • Functional impact review: If unauthenticated access is detected, review what actions were taken during those sessions — account creation, configuration changes, file access — to assess the full scope of any compromise.
• T1190 — Exploit Public-Facing Application
  • Inspect web server, reverse proxy, load balancer, and WAF logs for abnormal request patterns — unusual URIs, oversized payloads, HTTP verb abuse, or encoding anomalies.
  • Monitor for spikes in HTTP 4xx/5xx responses that may indicate probing or failed exploitation attempts preceding a successful hit.
  • Review outbound connections from affected servers for unexpected command-and-control callbacks or secondary payload retrieval to external IPs.
  • Validate which internet-facing assets are running the vulnerable version and verify whether compensating controls (WAF rules, network ACLs) are in place and effective.

Hunting Considerations

These are proactive hunts mapped to the ATT&CK techniques identified for this CVE. Run them now — do not wait for an alert to fire.

• T1190 — Exploit Public-Facing Application
  • Web/app server logs: Search for unusual HTTP methods, requests to non-standard paths, oversized payloads, or encoding anomalies (URL-encoded or double-encoded sequences) targeting the vulnerable application. Cluster by source IP and look for low-volume probing patterns before any successful hit.
  • Process telemetry: Hunt for child processes spawned by the web server or application process (e.g., apache2, nginx, w3wp.exe, java). Web server processes should not be launching shells, scripting engines (PowerShell, bash, python), or download utilities.
  • Outbound connections from the server: Alert on unexpected outbound HTTP/S or DNS from the application server to external IPs not in your CDN or update allowlist — this is a common secondary payload retrieval indicator post-exploitation.
  • File system writes: Look for new files written to web root directories, temp folders, or cron directories by the application process — especially scripts or executables placed there after an unusual inbound request.
  • Internal pivot follow-on: After gaining a foothold, attackers move laterally. Search for new internal connections originating from the compromised server in the hour following any suspicious external request.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Oracle PeopleSoft Enterprise PeopleTools. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.
• Apply compensating controls now: For systems that cannot be patched immediately, implement temporary mitigations: restrict access via firewall rules or ACLs, add WAF rules if applicable, disable or isolate the vulnerable component if feasible without breaking critical operations.
• Escalate and prepare for incident response: CISA has confirmed ransomware campaign use. Notify your security leadership, ensure backup integrity is validated and tested, and confirm your IR playbook is ready to activate if exploitation is detected.

Remediation

• Apply the vendor patch: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• CISA directive deadline: 2026-06-15 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.
• Post-patch review: After patching, review web server and application logs for signs of exploitation prior to remediation. A successful exploit may have left behind a web shell, new account, or scheduled task.

Detection Coverage

• Verify ATT&CK coverage: Confirm your SIEM and EDR have detection logic in place for T1190. Review the Detection Guidance and Hunting Considerations sections of this alert for the specific log sources and behavioral patterns to monitor.
• Unauthenticated exploitation monitoring: Because this vulnerability requires no authentication, internet-facing scanning and exploitation attempts may begin within hours of public disclosure. Ensure alerting is in place before the end of the day.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

https://www.oracle.com/security-alerts/alert-cve-2026-35273.html ; https://support.oracle.com/signin/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-35273