CriticalCVE-2026-35273

    Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (CVE-2026-35273)

    Published Last modified In CISA KEV since Sources: BSI, CVE.org

    What is affected, what to do

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62.

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Oracle PeopleSoft Enterprise PeopleTools eq 8.61..8.61
    • Oracle PeopleSoft Enterprise PeopleTools eq 8.62..8.62

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: BSI, CVE.org

    96.7 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.89

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    272.99 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    96.7 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.89
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This flaw can be exploited over HTTP without authentication or user interaction and yields full takeover of the PeopleTools platform. That makes it an ideal initial-access vector, and CISA explicitly flags it as used in ransomware campaigns. Its exploitation likelihood ranks among the very highest of all tracked CVEs. Typical targets are organisations running PeopleSoft for HR, payroll, finance or campus administration (public sector, universities, healthcare, utilities), where highly sensitive personal data enables double extortion. Treat any internet-exposed PeopleTools 8.61/8.62 instance as a top-priority emergency. Patch internal-only instances within days as well, since anyone with an internal foothold can use them for lateral movement and data theft.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory now: Identify every PeopleSoft instance running PeopleTools 8.61 or 8.62 (PIA web servers, app servers, Process Scheduler). You can read the PeopleTools level from "Help > About This Page" in PIA or from the PSSTATUS table. Prioritise internet-facing instances such as employee/candidate self-service or supplier portals.
      • Apply the vendor fix: A fix for the "Updates Environment Management" component is available from the vendor — look up the exact version in the vendor advisory, most likely the corresponding Oracle Critical Patch Update. Patch internet-facing systems first, as an emergency change if needed.
      • Lock down Environment Management endpoints: Until patched, block the Environment Management paths (typically /PSEMHUB/ and /PSEMAgent/) at the reverse proxy, load balancer or WAF for every source except the PUM/admin network. If the EM Hub is not required in production, disable the PSEMHUB webapp in the WebLogic domain.
      • Cut internet exposure: If patching must wait, place public PIA instances behind VPN or an IP allowlist. This covers HTTP/HTTPS on 80/443 and the PIA default ports 8000/8443 used in many installations.
      • Start a compromise assessment: Preserve web server logs (WebLogic access.log, PIA_access.log) back to at least the KEV addition date. Hunt for requests to EM paths, and check the filesystem and user tables as described under "Detection rules".
      • Rotate credentials on suspicion: If you find signs of exploitation, rotate PeopleSoft admin accounts (PS, VP1, Connect ID, Access ID), the WebLogic admin password, Integration Broker node passwords and database accounts. Treat the system as fully compromised and trigger your NIS2 incident-notification workflow (24 h early warning).

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Make app servers (Jolt/Tuxedo ports) and the database reachable only from the PIA web tier. Confine EM agent/hub traffic to a dedicated admin VLAN. Apply default-deny egress from PeopleSoft servers to the internet to hinder reverse shells and exfiltration.
      • WAF/reverse-proxy rule: Deny request URIs matching ^/PSEMHUB/ and ^/PSEMAgent/ from non-approved source IPs. Also block or alert on unusually large POST bodies and on serialised Java objects (magic bytes aced0005, Base64 rO0AB) sent to PeopleSoft paths.
      • Endpoint hardening: Run WebLogic/Java under a dedicated, unprivileged service account. Use EDR or AppLocker/SELinux policy to prevent java from spawning cmd.exe, powershell.exe, /bin/sh or bash. Restrict write access to the PIA webapp directories (PS_CFG_HOME/webserv/.../applications).
      • IAM/least privilege: Reduce the "PeopleSoft Administrator" and "Security Administrator" role holders to the minimum. Lock unused default user IDs. Prevent interactive logons with the Access ID database account.
      • Configuration change: If Environment Management is needed only during update cycles, shut down the EM agent (PSEMAgent) and hub between maintenance windows. Run PeopleSoft Update Manager in an isolated PUM environment, never on production.

    3. Runbook step 3

      Detection rules

      • Web access logs: Watch for requests to /PSEMHUB/hub or /PSEMAgent/ from outside the admin network, especially POSTs without a prior PIA sign-on (no PS_TOKEN cookie). SPL: index=web sourcetype=weblogic_access uri_path="/PSEMHUB/*" NOT src_ip IN (10.10.50.0/24) | stats count by src_ip, http_method, status
      • EDR process ancestry (Sysmon EID 1 / MDE): Look for shells spawned by Java/WebLogic. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","javaw.exe") and FileName in~ ("cmd.exe","powershell.exe","certutil.exe","whoami.exe"). On Linux, flag auditd execve records whose ppid is the WebLogic process and whose exe=/bin/sh.
      • File integrity (Sysmon EID 11 / auditd -w on webapp paths): New or modified .jsp, .war or .class files under the PIA/PSEMHUB directories indicate webshells. Sigma shape: TargetFilename|contains: '\\webserv\\' AND TargetFilename|endswith: '.jsp'.
      • Application/database layer: Alert on new rows or changes in PSOPRDEFN and PSROLEUSER that grant admin roles outside approved changes. Also alert on modified Integration Broker nodes and on new Process Scheduler jobs that execute OS commands.
      • Network telemetry (Zeek/Suricata): Flag outbound connections from PeopleSoft servers to unknown external hosts and large outbound transfers, which may be HR/finance data exfiltration ahead of encryption. Also flag SMB or RDP from the app tier into the internal network, a sign of lateral movement.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Source: BSI CSAF, BSI WID Portal, cvelistv5, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    VendorProductAffected versionsFixed in
    Oracle CorporationPeopleSoft Enterprise PeopleTools
    • 8.62
    • 8.61
    • —
    • —
    oraclepeoplesoft_enterprise_peopletools
    • 8.61
    • 8.62
    • —
    • —
    OraclePeopleSoft
    • Enterprise PeopleTools 8.61
    • Enterprise PeopleTools 8.62
    • —
    • —

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    SourceReferenceMaturityPublished
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)CVE-2026-35273-POC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-35273 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-35273 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • oracle.comOracle AdvisoryVendor advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273government-resource

    Reanalysis & status changes

    Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

    1. CVE Translatednvd@nist.gov

      • Translation: after Title: PeopleSoft Enterprise PeopleTools de Oracle Corporation, Description: Vulnerabilidad en el producto PeopleSoft Enterprise PeopleTools de Oracle PeopleSoft (componente: Updates Environment Management). Las versiones compatibles afectadas son 8.61 y 8.62. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red a través de HTTP comprometer PeopleSoft Enterprise PeopleTools. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de PeopleSoft Enterprise PeopleTools. Puntuación base CVSS 3.1 de 9.8 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    2. Initial Analysisnvd@nist.gov

      • CPE Configuration: after OR *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*
      • Reference Type: after CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273 Types: Third Party Advisory, US Government Resource
      • Reference Type: after Oracle: https://www.oracle.com/security-alerts/alert-cve-2026-35273.html Types: Vendor Advisory

    3. CVE CISA KEV Update9119a7d8-5eab-497f-8521-727c672e3725

      • Date Added: after 2026-06-12
      • Due Date: after 2026-06-12
      • Required Action: after 2026-06-12
      • Vulnerability Name: after 2026-06-12

    4. CVE Modified134c704f-9b21-4f2e-91b3-4a467353bcc0

      • Reference: after https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-35273
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-35273"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-35273.svg?lang=en" alt="CVE-2026-35273 – NEOSEC Intel" height="20"></a>