CVE-2026-35273 – Critical Unauthenticated RCE in Oracle PeopleSoft PeopleTools

CVE-2026-35273 is a Critical remote‑code‑execution flaw that can be triggered without authentication over HTTP against the Updates Environment Management component of Oracle PeopleSoft PeopleTools. The vulnerability carries a CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rating.

Key Takeaways

• Critical CVE-2026-35273 enables unauthenticated RCE.
• Affects Oracle PeopleSoft PeopleTools versions 8.61 and 8.62 (Updates Environment Management component).
• Active exploitation observed in the wild, notably by the ShinyHunters/UNC6240 extortion campaign targeting higher‑education.
• CISA KEV entry on 2026‑06‑12 mandates immediate remediation.
• Patch now available; apply or mitigate without delay.

Overview

Oracle released an advisory on 2026‑06‑10 warning of a missing authentication check in the Updates Environment Management module of PeopleTools. Within days, threat‑intel teams (Mandiant, Horizon3.ai) reported active exploitation by the ShinyHunters (UNC6240) extortion group, primarily targeting university environments. The U.S. CISA added the flaw to its KEV list on 2026‑06‑12, triggering the “must‑patch” directive for federal agencies and urging all organizations to prioritize remediation.

The vulnerability has generated 206 public mentions over a ten‑day window, with a pronounced spike on 2026‑06‑11/12 (over 100 mentions combined) and multiple reports of exploit tools in circulation. Real‑time threat signals, including IOC feeds and proof‑of‑concept releases, are tracked on the VulnSocial platform.

Technical Details

• Component: Updates Environment Management (PeopleTools)
• Vulnerable Versions: 8.61, 8.62 (full list in the CVE page)
• Root Cause: Missing authentication for a critical function that processes arbitrary HTTP requests. An attacker can send a crafted request to the endpoint, causing the server to execute attacker‑controlled code.
• Exploit Flow:
  1. Send a malicious HTTP request to the vulnerable endpoint (no credentials required).
  2. The server loads and executes the attacker‑supplied payload, granting full system control.
• CWE: CWE-306 – Missing Authentication for Critical Function.
• CVSS: CVSS 9.8 – Critical. Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Severity & Impact

The combination of network‑reachable, unauthenticated RCE means any exposed PeopleTools instance can be fully compromised, leading to data exfiltration, service disruption, and downstream compromise of connected enterprise systems.

Affected Products

• Oracle PeopleSoft PeopleTools – Updates Environment Management component
• Versions 8.61 and 8.62

For a complete list of affected editions and patches, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-35273.

Actionable Insights – What to Monitor

• Internet‑exposed instances: Scan for publicly reachable PeopleSoft sign‑in pages (e.g., via Shodan) and isolate them behind VPN or bastion hosts.
• Network traffic: Look for anomalous HTTP requests to the PeopleTools update endpoints.
• IOC feeds: Pull the latest indicators from the VulnSocial threat feed (https://vulnsocial.com) to detect ShinyHunters payloads.
• Log anomalies: Correlate sudden spikes in 5xx responses or unusual user‑agent strings with the timeline of reported exploitation (mid‑June 2026).
• Patch status: Verify that every PeopleTools instance reports the patch level released by Oracle; flag any lagging systems for immediate action.

Remediation & Mitigation

1. Patch immediately – Apply Oracle’s security update for PeopleTools 8.61/8.62 as described in the vendor advisory.
2. Network isolation – If a patch cannot be applied within 24 hours, block inbound traffic to the vulnerable endpoint at the perimeter firewall.
3. Disable EMHub – The extortion advisory recommends disabling the EMHub component until a permanent fix is in place.
4. Enforce least‑privilege – Restrict service‑account permissions on the PeopleSoft application server to limit the impact of a potential compromise.
5. Forensic triage – Follow CISA’s BOD 26‑04 guidance: collect memory dumps, review recent logins, and search for known ShinyHunters IOCs.
6. Validate remediation – After applying the patch, run the Oracle‑provided verification script or the Horizon3.ai Rapid Response test to confirm the vulnerability is closed.

Bottom Line

CVE-2026-35273 is a Critical unauthenticated RCE affecting Oracle PeopleSoft PeopleTools. With active exploitation already observed in the wild and a CISA KEV designation, organizations must patch immediately or apply strict network mitigations to avoid compromise.

References

• Oracle Security Advisory: https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273
• VulnSocial CVE page (real‑time intel): https://vulnsocial.com/cve/CVE-2026-35273
• VulnSocial home (general threat tracking): https://vulnsocial.com

#CVE202635273 #Critical #RCE #CISAKEV #Oracle #PeopleSoft #ZeroDay