Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Su

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleT

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise

U.S. CISA adds Oracle PeopleSoft Enterprise PeopleTools flaw to its Known Exploited Vulnerabilities catalog.

This is something I've been meaning to address for a while now. Quite a simple problem. The issue around having PeopleSoft pick the right va...

Introduction: Silent Enterprise Risk Hidden Inside Oracle PeopleSoft Infrastructure A newly disclosed critical vulnerability in Oracle’s PeopleSoft Enterprise PeopleTools has raised serious concern across enterprise IT environments worldwide. Affecting versions 8.61 and 8.62, this flaw sits inside the Updates Environment Management component and enables unauthenticated attackers to compromise systems remotely through HTTP access. What makes this vulnerability especially dangerous is its simplicity of exploitation combined with its severity.

This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) allows an unauthenticated attacker with network access via HTTP to remotely execute code and fully compromise the affected system. The flaw resides in t

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterpr

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleS

Oracle issued an out-of-band advisory for CVE-2026-35273, a critical PeopleSoft vulnerability that could allow unauthenticated remote code execution in PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Reports also link the issue to ShinyHunters activity targeting hundreds of PeopleSoft instances across more than 100 organizations, with organizations such as the University of Nottingham...

Oracle has issued an emergency Security Alert to address a critical remote code execution vulnerability (CVE-2026-35273) affecting PeopleSoft Enterprise PeopleTools. The vulnerability carries a CVSS v3.1 score of 9.8, highlighting its severity and the urgent need for remediation across enterprise environments. The flaw resides in the Updates Environment Management component of PeopleSoft PeopleTools and can be exploited remotely over HTTP. It does not require authentication or user interaction, making it particularly dangerous for internet-facing systems. Oracle confirmed that successful exploitation could allow attackers to execute arbitrary code, potentially leading to full system compromise. Security researchers from TrendAI Zero Day Initiative, including Bobby Gould, Lucas Miller, and Minh Giang, were credited with discovering and reporting the vulnerability. Their findings indicate that the attack complexity is low, which increases the likelihood of active exploitation attempts in the wild. The vulnerability impacts PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Oracle Emergency Security Update Oracle also warned that earlier or unsupported versions may be affected, even though they have not been formally tested. Since patches are only released for supported versions under Premier or Extended Support, organizations running outdated systems face additional risk if they do not upgrade. From a technical standpoint, the vulnerability allows network-based attacks without requiring any privileges. It affects confidentiality, integrity, and availability at a high level, meaning attackers could access sensitive data, modify system configurations, or disrupt services entirely. In a real-world scenario, a publicly exposed PeopleSoft instance could be compromised to deploy malicious payloads or facilitate lateral movement within a corporate network. Oracle has released patches and mitigation guidance as part of the Security Alert and strongly recommends immediate action. Organizations should prioritize applying the available updates, restrict external access to PeopleSoft environments, and monitor systems for suspicious activity. Maintaining systems on supported versions is also critical to ensure continued access to security updates. This issue underscores the ongoing threat posed by unauthenticated RCE vulnerabilities in widely deployed enterprise software. Given PeopleSoft’s role in managing critical business operations such as HR and finance, exploitation of this flaw could have significant operational and data security consequences. Organizations are advised to treat CVE-2026-35273 as a high-priority risk and take swift steps to secure their infrastructure. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post Oracle Emergency Security Update to Fix Critical RCE Vulnerability appeared first on Cyber Security News .

Last Updated: 2026-06-11T22:11:52Z (UTC) What’s Happening CVE-2026-35273, a CVSSv3 9.8 severity vulnerability allows “takeover” or “code execution.” No details on mechanism as yet. https://www.oracle.com/security-alerts/alert-cve-2026-35273.html The CVE listing shows the CWE as CWE-308, or “Missing Authentication for Critical Function.” So presumably an auth bypass or Broken Function Level Authorization on an API endpoint. The Register reports that ShinyHunters credit this vulnerability for ...

A deep-dive engineering playbook for detecting and neutralizing synchronized perimeter exploits hitting Ivanti Sentry and Oracle PeopleSoft. Establish structural middleware surveillance and block active C2 propagation.