Oracle CVE-2026-35273: PeopleSoft Enterprise PeopleTools Critical

Описание: CRITICAL · CVE-2026-35273 · actively exploited — Unauthenticated takeover of PeopleSoft Enterprise PeopleTools

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

A flaw in Oracle PeopleSoft Enterprise PeopleTools login checks grants access without valid credentials.

▸ CVE: CVE-2026-35273
▸ Product: Oracle PeopleSoft Enterprise PeopleTools
▸ Severity: CRITICAL (CVSS 9.8)
▸ Mechanism: Oracle · PeopleSoft Enterprise PeopleTools · RCE
▸ Threat intel: CISA KEV — known exploited in the wild · KEV added 2026-06-12 · Federal deadline 2026-06-15
▸ Public PoC artifacts reported

AFFECTED
• Oracle PeopleSoft Enterprise PeopleTools — patch to 8.61 or later
• No login required to exploit

REMEDIATION
• Upgrade to supported versions
• Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines
• Hunt Oracle PeopleSoft Enterprise PeopleTools access and auth logs · SIEM search CVE-2026-35273

SOURCES
• NVD: https://nvd.nist.gov/vuln/detail/CVE-...
• CISA KEV: https://www.cisa.gov/known-exploited-...

Stack Sentinel 7 — automated CVE briefings. Verify patches with your vendor before production changes. Not official vendor or CISA guidance.

Subscribe: https://www.youtube.com/@StackSentine...

#CVE-2026-35273 #PeopleSoftEnterprisePeopleTools #RCE #CVE #CISAKEV #cybersecurity