CVE-2026-35273

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning that critical functions of the Updates Environment Management component are accessible without any authentication. An attacker with network access to the system can send HTTP requests without providing credentials and gain full access to sensitive operations. The flaw is easy to exploit — it does not require special privileges or user interaction.

A successful attack leads to complete takeover of the PeopleSoft Enterprise PeopleTools system, including violation of confidentiality, integrity, and availability of data (C:H/I:H/A:H). An attacker can read, modify, or delete data, as well as cause system unavailability (DoS).

Patches released by Oracle must be applied immediately in accordance with the security alert available at https://www.oracle.com/security-alerts/alert-cve-2026-35273.html. Due to active exploitation of the vulnerability in the wild, the update should be deployed with priority. Until the patch is installed, it is recommended to restrict network access to the Updates Environment Management component exclusively to trusted IP addresses.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.