CVE-2026-35273
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 12, 2026
- US federal agencies must remediate it by Jun 15, 2026 (BOD 22-01)
- Attacked on the day of disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 29, 2026 Oct 28, 2026 Oct 24, 2026 Oct 23, 2026 Oct 22, 2026 Oct 19, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| oracle | peoplesoft enterprise peopletools | 8.61 |
Related articles
ShinyHunters Suspect Detained as Boeing Reviews Separate Jeppesen ForeFlight Data Claims
Sources allege ShinyHunters operator Rey sought to extort Jeppesen ForeFlight as Boeing reviews claims; detention and data theft remain unconfirmed.
ShinyHunters Probe Reaches the Netherlands as Attacks Shift Toward Higher-Risk Targets
Dutch police detained convicted hacker Pepijn van der Stap in ShinyHunters probe amid Odido theft, FBI portal breach and PeopleSoft flaw exploitation.
Encoded Requests Let ShinyHunters-Linked Attackers Breach Oracle PeopleSoft Servers
UNC6240 exploits CVE-2026-35273 in Oracle PeopleSoft via encoded PSEMHUB requests, bypassing WAFs to deploy JSP shells and SIDEEYE backdoor.
FBI Probes ShinyHunters Claim After Recruitment Portal Defacement
FBI investigates ShinyHunters claim of FBIjobs.gov breach, portal defacement and alleged theft of agent data. Scope remains unverified.
Oracle CVE-2026-21962 enters KEV: maximum score and unauthorized access to WebLogic
CISA adds Oracle CVE-2026-21962 to KEV catalog. Critical CVSS 10.0 flaw allows unauthorized WebLogic access. Remediation due Aug 27, 2026.
This product uses the NVD API but is not endorsed or certified by the NVD.