CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function

Exploited in the wild Critical 9.8 Published 11 Jun 2026 Updated 4 Aug 2026

Unauthenticated attackers can bypass authentication to fully compromise PeopleSoft Enterprise PeopleTools via HTTP.

Exploited in the wild: Since 12 Jun 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35273?

CVE-2026-35273 is a critical authentication bypass vulnerability in Oracle Peoplesoft Enterprise Peopletools, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-306

Which versions are affected by CVE-2026-35273?

It affects 1 product.

Products include Oracle Peoplesoft Enterprise Peopletools.

How do I fix CVE-2026-35273?

No fix has been published for CVE-2026-35273 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Jun 2026.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-35273 being exploited?

Yes. Attackers have exploited CVE-2026-35273 in the wild since at least 12 Jun 2026, including in ransomware campaigns.

Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.

All Oracle Peoplesoft Enterprise Peopletools vulnerabilities

Sources

Also known as GHSA-25mw-359m-f6rj.