CVE-2026-35273
Allows unauthenticated attacker to take over PeopleSoft Enterprise PeopleTools
This is a critical missing-authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. An unauthenticated attacker can exploit it over HTTP to fully compromise the software. CISA has confirmed active exploitation and added it to its known-exploited list, but Oracle has not yet released a fix.
Oracle Corporation PeopleSoft Enterprise PeopleTools · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 12 June; US agencies must fix by 15 June. Used by ransomware gangs
SeveritycriticalCVSS 9.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fix is available yet; monitor Oracle's security alerts for patching guidance.
- Until a patch is released, isolate affected systems where possible and follow CISA's recommended mitigations for the known-exploited vulnerability.
What happened
- 12 JuneCISA adds PeopleSoft Enterprise PeopleTools vulnerability to known-exploited list, requiring federal agencies to fix by June 15.
- 28 OctThe Hacker News reports that the ShinyHunters group has been exploiting this zero-day as three chained vulnerabilities.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | critical 9.8 | 12 June | 97% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
The Hacker News · 28 OctShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws ↗The records
oracle.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-35273 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works