Critical Unauthenticated RCE Vulnerability in Oracle PeopleSoft Exploited: CVE-2026-35273
Executive Summary
In early June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in its PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component. This flaw, present in versions 8.61 and 8.62, allows unauthenticated attackers with network access via HTTP to execute remote code, potentially leading to full system compromise. The vulnerability was actively exploited between May 27 and June 9, 2026, before Oracle released a patch on June 10. Over 100 organizations were affected, with data exfiltration reported from nearly 300 PeopleSoft instances. The cyber extortion group ShinyHunters is believed to be behind these attacks, though some experts suggest possible impersonation. (techradar.com)
This incident underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in widely used enterprise applications. The rapid exploitation of CVE-2026-35273 highlights the importance of timely patch management and proactive monitoring to detect and mitigate such threats before they can cause significant damage.
Why This Matters Now
The rapid exploitation of CVE-2026-35273 underscores the critical need for organizations to promptly apply security patches and enhance monitoring to detect unauthorized access, especially in widely used enterprise applications like Oracle PeopleSoft.
Attack Path Analysis
An unauthenticated attacker exploited CVE-2026-35273 to gain initial access to Oracle PeopleSoft Enterprise PeopleTools. Upon access, the attacker escalated privileges to gain administrative control. They then moved laterally within the network to access additional systems. The attacker established a command and control channel to maintain persistent access. Sensitive data was exfiltrated from compromised systems. Finally, the attacker deployed ransomware, encrypting critical data and demanding payment.
Kill Chain Progression
Initial Compromise
Description
Exploited CVE-2026-35273 to gain unauthenticated access to Oracle PeopleSoft Enterprise PeopleTools.
Related CVEs
CVE-2026-35273
CVSS 9.8An easily exploitable vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows unauthenticated attackers with network access via HTTP to compromise the system, potentially resulting in a complete takeover.
Affected Products:
Oracle PeopleSoft Enterprise PeopleTools – 8.61, 8.62
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Valid Accounts
Modify Authentication Process
Application Layer Protocol
OS Credential Dumping
Remote Services
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Oracle PeopleSoft authentication bypass vulnerability directly impacts federal agencies required to remediate KEV catalog vulnerabilities under BOD 26-04 compliance mandates.
Higher Education/Acadamia
PeopleSoft Enterprise systems widely deployed for student information management face critical authentication bypass risks requiring immediate zero trust segmentation implementation.
Financial Services
Authentication bypass in PeopleSoft threatens financial data integrity, demanding enhanced egress security controls and threat detection capabilities per regulatory requirements.
Health Care / Life Sciences
Missing authentication controls in PeopleSoft systems expose protected health information, violating HIPAA 164.312 requirements and necessitating encrypted traffic solutions.
Sources
- CISA Adds One Known Exploited Vulnerability to Cataloghttps://www.cisa.gov/news-events/alerts/2026/06/12/cisa-adds-one-known-exploited-vulnerability-catalogVerified
- CVE-2026-35273 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2026-35273Verified
- Oracle Security Alert for CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it embeds security directly into the cloud fabric, potentially limiting the attacker's ability to move laterally and exfiltrate data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's initial access may have been constrained by identity-based policies, reducing unauthorized entry points.
Control: Zero Trust Segmentation
Mitigation: Privilege escalation attempts could have been limited by enforcing least-privilege access controls.
Control: East-West Traffic Security
Mitigation: Lateral movement may have been constrained by segmenting workloads and enforcing strict east-west traffic controls.
Control: Multicloud Visibility & Control
Mitigation: Establishing command and control channels could have been limited by continuous monitoring and control of outbound communications.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts may have been constrained by enforcing strict egress policies and monitoring outbound data flows.
The deployment of ransomware could have been limited by restricting unauthorized access and isolating compromised workloads.
Impact at a Glance
Affected Business Functions
- Human Resources Management
- Financial Management
- Supply Chain Management
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive employee and financial data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation of known vulnerabilities.
- • Utilize Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing data exfiltration.
- • Establish Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Apply patches promptly to address known vulnerabilities like CVE-2026-35273.
