CVE-2026-35273: Oracle PeopleSoft PeopleTools unauthenticated RCE, exploited as a zero-day
The short version: CVE-2026-35273 is an unauthenticated flaw in the Environment Management component of Oracle PeopleSoft Enterprise PeopleTools that leads to remote code execution and server takeover. It was exploited in the wild as a zero-day — weeks before Oracle's advisory — by the extortion group ShinyHunters, hitting 100+ organizations. It's in CISA's KEV catalog with an immediate deadline, and Oracle shipped an out-of-band patch the same day it disclosed. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 92.3% · 99.8th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-06-15 |
| Known exploited? | Yes — zero-day exploitation by ShinyHunters (UNC6240); known ransomware/extortion use; 100+ organizations |
| Vulnerability type | CWE-306 missing authentication for a critical function → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Updates Environment Management) |
| Fixed in | PeopleTools 8.63 (and the out-of-band patch for 8.61/8.62) |
What you need to know
PeopleTools is the platform under Oracle's PeopleSoft applications (HR, finance, campus systems), and its Environment Management Hub (PSEMHUB) and integration gateway are HTTP-reachable. CVE-2026-35273 is a missing-authentication flaw reached via the /PSEMHUB/hub and /PSIGW/HttpListeningConnector endpoints, letting an unauthenticated attacker compromise the server and execute code.
This one was operational before it was public:
- It's unauthenticated and internet-reachable. No login, just HTTP access to the exposed endpoints.
- It was a live zero-day. Threat intelligence reporting placed active exploitation between late May and early June 2026 — roughly two weeks before Oracle's alert.
- A named extortion crew ran it. Google/Mandiant attributed the campaign to ShinyHunters (UNC6240), affecting more than 100 organizations, heavily weighted toward higher education. Post-exploitation used PeopleSoft-specific tooling and credential theft from
psappsrv.cfg. - It can pull hashes outward. The exploit chain can force outbound SMB connections, exposing Windows machine-account NetNTLM hashes.
How serious we see it
High — the 9.8 is fully earned.
Unauthenticated, low-complexity RCE on an internet-facing enterprise platform, exploited as a zero-day by an extortion group against a hundred-plus victims, and in CISA's KEV catalog, is about as clear-cut as prioritization gets. There's no gap to explain here — paper and practice agree.
The bounded, reassuring part: it affects specific PeopleTools versions via specific endpoints, the fix and compensating controls are published, and both are quick to apply. The catch is the zero-day window — assume exposed, unpatched systems may already have been hit, and investigate accordingly.
Recommendations
Straight from Oracle's Security Alert and Mandiant's guidance:
- Patch now. Apply Oracle's out-of-band patch for CVE-2026-35273 to PeopleTools 8.61/8.62, or move to PeopleTools 8.63.
- Restrict the endpoints. Block external access to
/PSEMHUB/*and/PSIGW/HttpListeningConnector; disable or remove the Environment Management Hub where it isn't needed. This is reported non-breaking for standard end-user sessions. - Hunt — assume pre-patch exposure. Look for exploitation of those endpoints, unexpected outbound SMB (TCP 445), and PeopleSoft-specific post-exploitation tooling; review
psappsrv.cfgaccess. - If you find indicators, respond fully. Rotate credentials (including any exposed in config), and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an affected PeopleTools version with those endpoints reachable. Don't treat older, unlisted builds as safe — Oracle notes they're likely affected too.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing PeopleSoft interfaces, fingerprints PeopleTools, and flags exposure tied to this KEV-listed, actively exploited flaw — pushed to the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single crafted request to the affected endpoint and checks the response for the tell-tale signs of the flaw, confirming the exposure holds rather than deploying a working exploit.
That continuous, attacker's-eye view is exactly what you want when a zero-day breaks: the exposed, affected server is already mapped, so you go straight to patch-and-verify.