What is the CVSS score of CVE-2026-35273?

CVE-2026-35273 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-35273?

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a critical vulnerability enabling remote complete system takeover without authentication requirements.

Is there a public PoC exploit available for CVE-2026-35273?

Yes, a public proof-of-concept exploit is available for CVE-2026-35273. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-35273?

Within 24 hours: Identify and inventory all Oracle PeopleSoft PeopleTools 8.61 and 8.62 instances across production and non-production environments. Within 7 days: Apply compensating controls (restrict network access via firewall/VPN, disable Updates Environment Management component if unused, deploy WAF rules blocking the affected endpoint). Within 30 days: Establish direct engagement with Oracle support for patch availability timeline and execute upgrade plan to patched version once released.

PeopleSoft PeopleTools CVE-2026-35273

EUVD-2026-36199 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-11 oracle

GHSA-25mw-359m-f6rj

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP exploitation with low complexity yielding full product takeover, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jun 12, 2026 - 18:01 CISA

Analysis Generated

Jun 11, 2026 - 03:41 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Articles & Coverage 1

POC CVE-2026-35273: Unauthenticated RCE in Oracle PeopleSoft PeopleTools 8.61/8.62 (CVSS 9.8) Jun 12, 2026

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is the application development and runtime framework underlying Oracle's PeopleSoft ERP suite (HCM, FSCM, Campus Solutions). The affected component, Updates Environment Management, is the subsystem responsible for distributing and applying Oracle-supplied PeopleTools patches, PeopleSoft Update Images (PIs), and environment configuration across application, batch, and web server tiers. Per the CPE data, this affects cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools across versions 8.61 and 8.62. No CWE was assigned by NVD, but the combination of unauthenticated HTTP attack vector and full system takeover impact is consistent with classes such as authentication bypass, unsafe deserialization, or command injection in management interfaces - common root causes in Java-based Oracle middleware components.

RemediationAI

Apply the fix from Oracle's out-of-cycle security alert at https://www.oracle.com/security-alerts/alert-cve-2026-35273.html as the primary remediation; consult the alert for the exact PeopleTools patch identifiers corresponding to your 8.61 or 8.62 deployment, as exact fix version numbers were not provided in the input data (Patch available per vendor advisory). Until the patch is deployed, restrict network reachability to the PeopleTools web/PIA tier and the Updates Environment Management endpoint to trusted administrative networks via WAF, reverse-proxy ACLs, or perimeter firewall rules - note this will break self-service portal access for any users outside those networks. Increase web access log monitoring for anomalous requests to environment-management URIs and review PeopleSoft administrative accounts for unexpected changes, since post-exploitation may include credential and configuration tampering.