CVE-2026-35273

Analyzed Analyzed - Analysis Complete

PeopleTools Remote Code Execution Vulnerability

Publication date: 2026-06-11

Last updated on: 2026-06-12

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-11

Last Modified

2026-06-12

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-35273

EUVD

EUVD-2026-36199

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_peopletools	8.61
oracle	peoplesoft_enterprise_peopletools	8.62

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-35273 is a critical security vulnerability in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, specifically affecting the Updates Environment Management component. It allows an unauthenticated attacker to remotely exploit the system over HTTP without needing any privileges or user interaction.

Successful exploitation can lead to remote code execution, enabling the attacker to take over the PeopleSoft Enterprise PeopleTools environment.

The vulnerability has a very high severity with a CVSS v3.1 base score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Impact Analysis

This vulnerability can have severe impacts including complete takeover of the PeopleSoft Enterprise PeopleTools system.

An attacker exploiting this flaw can execute arbitrary code remotely, potentially leading to unauthorized access, data breaches, data manipulation, and disruption of services.

Because the exploit requires no authentication and has low attack complexity, it poses a significant risk to affected organizations if not promptly mitigated.

Mitigation Strategies

Oracle strongly recommends immediate action to mitigate this vulnerability by applying the provided patches or security updates.

Affected users should upgrade to supported versions, as patches are only available for products under Premier or Extended Support phases of Oracle's Lifetime Support Policy.

Customers are urged to review the Technical Support Policies and apply necessary updates promptly to reduce exposure.

Compliance Impact

CVE-2026-35273 is a critical vulnerability that allows unauthenticated remote attackers to compromise Oracle PeopleSoft PeopleTools, potentially leading to full system takeover. Such a compromise can result in unauthorized access to sensitive data, impacting confidentiality, integrity, and availability.

Because of the high impact on confidentiality and integrity, this vulnerability could negatively affect compliance with data protection regulations and standards such as GDPR and HIPAA, which require organizations to protect personal and sensitive information from unauthorized access and breaches.

Organizations using affected versions of PeopleSoft PeopleTools must promptly apply patches or mitigations to reduce the risk of data breaches and maintain compliance with these regulations.

Hi! I’m here to help you understand CVE-2026-35273. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70