Oracle Issues Emergency Patch for Critical Unauthenticated RCE in PeopleSoft PeopleTools (CVE-2026-35273)

Oracle has issued an emergency Security Alert to address a critical remote code execution vulnerability (CVE-2026-35273) affecting PeopleSoft Enterprise PeopleTools. The vulnerability carries a CVSS v3.1 score of 9.8, highlighting its severity and the urgent need for remediation across enterprise environments.

The flaw resides in the Updates Environment Management component of PeopleSoft PeopleTools and can be exploited remotely over HTTP. It does not require authentication or user interaction, making it particularly dangerous for internet-facing systems. Oracle confirmed that successful exploitation could allow attackers to execute arbitrary code, potentially leading to full system compromise.

Security researchers from TrendAI Zero Day Initiative, including Bobby Gould, Lucas Miller, and Minh Giang, were credited with discovering and reporting the vulnerability. Their findings indicate that the attack complexity is low, which increases the likelihood of active exploitation attempts in the wild.

The vulnerability impacts PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Oracle also warned that earlier or unsupported versions may be affected, even though they have not been formally tested. Since patches are only released for supported versions under Premier or Extended Support, organizations running outdated systems face additional risk if they do not upgrade.

From a technical standpoint, the vulnerability allows network-based attacks without requiring any privileges. It affects confidentiality, integrity, and availability at a high level, meaning attackers could access sensitive data, modify system configurations, or disrupt services entirely. In a real-world scenario, a publicly exposed PeopleSoft instance could be compromised to deploy malicious payloads or facilitate lateral movement within a corporate network.

Oracle has released patches and mitigation guidance as part of the Security Alert and strongly recommends immediate action. Organizations should prioritize applying the available updates, restrict external access to PeopleSoft environments, and monitor systems for suspicious activity. Maintaining systems on supported versions is also critical to ensure continued access to security updates.

This issue underscores the ongoing threat posed by unauthenticated RCE vulnerabilities in widely deployed enterprise software. Given PeopleSoft’s role in managing critical business operations such as HR and finance, exploitation of this flaw could have significant operational and data security consequences. Organizations are advised to treat CVE-2026-35273 as a high-priority risk and take swift steps to secure their infrastructure.

Mandiant CTO Charles Carmakal has now confirmed active exploitation of CVE-2026-35273 in the wild, corroborating Oracle's out-of-band alert. The vulnerability, a remotely exploitable unauthenticated RCE in PeopleTools 8.61 and 8.62, is being leveraged by the ShinyHunters extortion group, which claims to have breached over 100 organizations—primarily educational institutions—using a gadget chain of old and zero-day flaws. A threat researcher also discovered exposed directories containing attack tools and a shell script designed to spread defacement markers across PeopleSoft infrastructure, indicating deep familiarity with the platform.

The SecurityWeek report adds that the ShinyHunters group claimed to have targeted 300 PeopleSoft instances across more than 100 organizations, chaining old and zero-day exploits to steal data. The education sector was hit hardest, with the University of Nottingham confirming a significant data breach. Mandiant CTO Charles Carmakal has warned about the zero-day exploitation, though Oracle has not officially confirmed in-the-wild attacks.

BleepingComputer has now confirmed that CVE-2026-35273 is the zero-day exploited by the ShinyHunters extortion gang, which claims to have stolen data from over 300 PeopleSoft instances across more than 100 organizations. Oracle has released emergency mitigations for PeopleTools versions 8.61 and 8.62, with a full patch pending. Organizations are advised to check logs for connections from known attacker IP addresses, including 142.11.200[.]186-190 and 108.174.202[.]99.

Rapid7's analysis, published June 12, 2026, provides additional technical details on the exploit chain, confirming that the SSRF vulnerability (CWE-918) is exploited via the /PSEMHUB/hub and /PSIGW/HttpListeningConnector endpoints, and may trigger outbound SMB connections to capture NetNTLM hashes. The report also includes indicators of compromise, such as MeshCentral agents masquerading as Azure services, and emphasizes that patching should be prioritized even after investigation due to exploitation beginning as early as May 27.

CISA has now added CVE-2026-35273 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation of the Oracle PeopleSoft PeopleTools flaw. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of this vulnerability on publicly exposed assets that grant total control post-exploitation. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize patching this critical flaw.

Trend Micro Research has now published a full technical breakdown of the exploitation chain, revealing that the attack leverages an SSRF in the PSIGW gateway to reach an internal management servlet, then achieves code execution via Java XMLDecoder deserialization inside the WebLogic JVM. The chain is notably stealthy: execution occurs on web-tier restart with no child process or outbound beacon, evading common detection signatures. The researchers also note that Oracle's prior serialization-filter hardening does not cover this XMLDecoder code path, meaning fully patched installations remain vulnerable without the out-of-band fix.

The ZDI advisory (ZDI-26-389) adds technical depth to the previously disclosed CVE-2026-35273, revealing that the vulnerability resides in the ExecuteProcessActivityCommand class and stems from improper validation of user-supplied file paths. The advisory also credits Bobby Gould, Minh Giang, and Lucas Miller of TrendAI for discovering the flaw, and notes that while authentication is required, the existing authentication mechanism can be bypassed, effectively making the bug exploitable by unauthenticated attackers.

The ZDI advisory (ZDI-26-388) adds technical depth to the previously disclosed CVE-2026-35273, revealing that the vulnerability resides in the HubMBeanPersistance component and stems from improper validation of user-supplied data leading to deserialization of untrusted data. The advisory credits Bobby Gould, Minh Giang, and Lucas Miller of TrendAI for the discovery and notes that while authentication is required, the existing mechanism can be bypassed, enabling remote code execution in the context of the service account. Oracle has issued a fix via its security alert page.

The ZDI advisory (ZDI-26-387) now provides full technical details for CVE-2026-35273, describing it as an SSRF flaw in the HttpListeningConnector class that requires no authentication and carries a CVSS score of 9.3. The disclosure credits Bobby Gould, Minh Giang, and Lucas Miller of TrendAI's Zero Day Initiative, and confirms Oracle released a fix via its security alert page. While the earlier emergency patch announcement noted a 9.8 CVSS RCE rating, the ZDI analysis clarifies the root cause is SSRF, which can be chained with other vulnerabilities to achieve code execution.