CVE-2026-35273
Received Received - Intake
PeopleTools Remote Code Execution Vulnerability

Publication date: 2026-06-11

Last updated on: 2026-06-11

Assigner: Oracle

Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-11
Last Modified
2026-06-11
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2026-35273
EUVD
EUVD-2026-36199
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
oracle peoplesoft_enterprise_peopletools 8.61
oracle peoplesoft_enterprise_peopletools 8.62
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-35273 is a critical security vulnerability in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, specifically affecting the Updates Environment Management component. It allows an unauthenticated attacker to remotely exploit the system over HTTP without needing any privileges or user interaction.

Successful exploitation can lead to remote code execution, enabling the attacker to take over the PeopleSoft Enterprise PeopleTools environment.

The vulnerability has a very high severity with a CVSS v3.1 base score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Impact Analysis

This vulnerability can have severe impacts including complete takeover of the PeopleSoft Enterprise PeopleTools system.

An attacker exploiting this flaw can execute arbitrary code remotely, potentially leading to unauthorized access, data breaches, data manipulation, and disruption of services.

Because the exploit requires no authentication and has low attack complexity, it poses a significant risk to affected organizations if not promptly mitigated.

Mitigation Strategies

Oracle strongly recommends immediate action to mitigate this vulnerability by applying the provided patches or security updates.

Affected users should upgrade to supported versions, as patches are only available for products under Premier or Extended Support phases of Oracle's Lifetime Support Policy.

Customers are urged to review the Technical Support Policies and apply necessary updates promptly to reduce exposure.

Compliance Impact

CVE-2026-35273 is a critical vulnerability that allows unauthenticated remote attackers to compromise Oracle PeopleSoft PeopleTools, potentially leading to full system takeover. Such a compromise can result in unauthorized access to sensitive data, impacting confidentiality, integrity, and availability.

Because of the high impact on confidentiality and integrity, this vulnerability could negatively affect compliance with data protection regulations and standards such as GDPR and HIPAA, which require organizations to protect personal and sensitive information from unauthorized access and breaches.

Organizations using affected versions of PeopleSoft PeopleTools must promptly apply patches or mitigations to reduce the risk of data breaches and maintain compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart