WaratekVRT Sign in

CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools

Affected softwareOracle PeopleSoft Enterprise PeopleTools
Affected versions8.61, 8.62
Severity9.8 Critical CVSS 3.1
Fixed inOracle Security Alert CVE-2026-35273
WeaknessMissing authentication (CWE-306)
Published11 Jun 2026
Updated13 Nov 2026

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2026-06-12 · remediation due 2026-06-15 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 22 citations · honeypot sightings · earliest 2026-06-11.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2026-06-12.
  • EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2026-35273 in VulnCheck (free account), which lists 17 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 38 days 2026-07-10 to 2026-11-06
Reported exploitation attackerkb.com /topics/X6A7O54UPA/cve-2026-35273 2026-06-11
Reported exploitation cloud.google.com /blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit 2026-06-11
Reported exploitation linkedin.com /posts/charlescarmakal_urgent-multiple-0-day-vulnerabilities-share-7470696836803117057-mf6m 2026-06-11
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2026-06-12
Reported exploitation rapid7.com /blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273 2026-06-12

3 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC CVE-2026-35273 4 2026-06-12
GitHub PoC CVE-2026-35273 3 2026-06-12
GitHub PoC CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated RCE Scanner 1 2026-06-26
Nuclei Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Marshal RCE rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule

PeopleSoft pre-auth SSRF-to-deserialization RCE (CWE-918 -> CWE-502; NVD labels it CWE-306): an unauthenticated POST to /PSIGW/HttpListeningConnector makes the Integration Broker fetch a loopback URL for /PSEMHUB/hub, satisfying the hub's IP-based validateClient check; the hub's OPERATION parameter (a serialized Java object) is then used to plant a crafted XML file under envmetadata/data/environment/, which java.beans.XMLDecoder executes on the next web-tier restart. The Marshal deserialize(java)+rce() rule covers both boundaries — ObjectInputStream.readObject() and java.beans.XMLDecoder — and the XMLDecoder one is where code execution actually happens. Note the chain is fork-free and in-JVM, so the Process rule is not cover for this CVE.

Sources:

How to mitigate CVE-2026-35273

Apply the fix in Oracle Security Alert CVE-2026-35273. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Security Alert CVE-2026-35273 ↗ Alert 2026-Q2 Oracle PeopleSoft / Updates Environment Management (8.61, 8.62)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle PeopleSoft Updates Environment Management 8.61, 8.62 8.61 · 8.62

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle peoplesoft enterprise peopletools generic 8.61 · 8.62

References

URLTags
https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
https://support.oracle.com/signin/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273 Third Party Advisory, US Government Resource

Timeline
Published2026-06-11By the CVE Program.
VulnCheck KEV: earliest evidence2026-06-11Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2026-06-12Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-07-23NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-06Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.