What breaks and who should care
If your organisation runs Oracle PeopleSoft Enterprise PeopleTools, an unauthenticated attacker can now take full control of the application. That means they could create, modify, or delete data, impersonate users, and even deploy ransomware. Anyone responsible for PeopleSoft – system owners, administrators, and security teams – needs to treat this as an emergency.
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
Vulnerability details
The National Vulnerability Database describes CVE-2026-35273 as a “missing authentication for critical function” vulnerability. In plain English, a part of PeopleTools that should only be reachable by a logged‑in user can be called without any credentials. The code path that grants the attacker the ability to execute privileged actions is not protected by the usual session checks.
The exact function that is exposed has not been disclosed publicly. Oracle has not released a detailed technical advisory beyond the brief description. What we do know is that the flaw falls into the class of authentication bypass bugs – a long‑standing problem where the software fails to verify the identity of the caller before performing a sensitive operation.
Because the vulnerability is unauthenticated, an attacker does not need any knowledge of existing user accounts. They can simply send a crafted request to the PeopleTools server and, if the request reaches the vulnerable endpoint, they gain the same rights as an administrator.
Impact assessment
The CVSS base score is 9.8, which lands it firmly in the critical range. That score reflects the ease of exploitation (no authentication required), the breadth of impact (full system takeover), and the potential for data loss or ransomware deployment.
Exploitation has been confirmed in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog on 12 June 2026, and it appears in ransomware campaign reports. In short, attackers are already using this flaw to breach organisations that run PeopleTools.
How to determine if you’re exposed
First, confirm whether PeopleSoft PeopleTools is present on any of your hosts. On a Unix‑like system you can run:
ps -ef | grep -i peoplesoftrpm -qa | grep -i peopletools(for RPM‑based Linux)dpkg -l | grep -i peopletools(for Debian‑based Linux)
If the product is installed, the next question is whether the vulnerable component is reachable from the network. Check any firewalls or security groups that expose the PeopleTools web tier. A quick way to see if the service is listening on the default port is:
netstat -tulnp | grep -i 80ss -tulnp | grep -i 443
Look for a process owned by the PeopleTools application. If it is bound to an address other than 127.0.0.1, it is potentially reachable from other hosts.
Next, verify whether the vulnerable endpoint is publicly accessible. From a remote machine, try a simple HTTP request against the base URL:
curl -I http://your‑peopletools‑host/psp/ps/
If you receive a HTTP 200 response, the web tier is reachable. You do not need to send a malicious payload at this stage – just confirming reachability is enough to know you need to act.
Finally, check for any existing patches. Oracle typically publishes security bulletins that list the affected releases and the corresponding fixed releases. The table below, automatically generated from NVD, shows which releases are known to be vulnerable and which contain the fix.
Mitigation and remediation
The definitive fix is to apply Oracle’s security update that addresses CVE-2026-35273. Oracle’s guidance is to upgrade to the patched release for your branch. Do not attempt to guess which version includes the fix – use the table below and Oracle’s official advisory to select the correct package.
Steps to apply the patch:
- Download the appropriate PeopleTools security update from Oracle Support.
- Back up your PeopleSoft configuration and database.
- Stop the PeopleTools application server and web tier.
- Install the update using the standard Oracle deployment method (for example,
opatch applyon Linux). - Restart the services and verify the version string in the PeopleTools console.
After the upgrade, run the same curl test as before. A successful response still indicates the service is up, but the underlying code now includes the authentication check, so the exploit will no longer work.
Temporary mitigations
If, for any reason, you cannot apply the patch immediately, you should put in place defence‑in‑depth controls to buy time.
- Network segmentation: Restrict inbound traffic to the PeopleTools web tier to only the IP ranges that need it. Use firewalls or security groups to block all other sources.
- Web‑application firewall (WAF): Configure a rule that blocks the specific URL pattern associated with the vulnerable function. Oracle may publish the exact path in its advisory – block it if you can.
- Disable remote access: If the PeopleTools server does not need to be reachable from the internet, move it behind a VPN or internal network.
- Strong monitoring: Enable audit logging for all PeopleTools admin actions. Look for unexpected logins, creation of new admin accounts, or mass data exports.
These mitigations do not remove the vulnerability, but they raise the bar for an attacker and may prevent the exploit from succeeding while you arrange for a patch.
If no patch is yet available
In the unlikely event that Oracle has not yet released a fix for your specific deployment, follow these steps:
- Isolate the affected host from the network. Disconnect it from any external connections that are not strictly required.
- Apply the temporary mitigations listed above – especially firewall restrictions and WAF rules.
- Enable continuous monitoring. Use a SIEM to alert on any PeopleTools admin‑level API calls.
- Contact Oracle Support immediately. Open a high‑severity ticket referencing CVE-2026-35273 and request an emergency patch or workaround.
While you wait, keep an eye on CISA’s advisories. They will update the Known Exploited Vulnerabilities catalog if new information becomes available.
Compliance guidance
CISA’s Binding Operational Directive (BOD) 26‑04 requires organisations to prioritise security updates based on risk. CVE-2026-35273, with a CVSS of 9.8 and confirmed exploitation, sits at the top of that priority list. Apply the patch as soon as possible and document the action in your change‑management system.
The same BOD also references the “Forensics Triage Requirements”. If you suspect an intrusion, preserve volatile memory, collect PeopleTools logs, and retain network traffic captures. Those artefacts will be essential for any post‑incident investigation.
References
- National Vulnerability Database entry for CVE-2026-35273.
- Oracle Security Bulletin – PeopleTools authentication bypass (link provided by Oracle).
- CISA Known Exploited Vulnerabilities catalog – entry for CVE-2026-35273 (added 12 June 2026).
- CISA BOD 26‑04 – Prioritising Security Updates Based on Risk.
Affected versions
NVD has not published machine-readable version ranges for CVE-2026-35273 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
