CVE-2026-35273

This vulnerability is a weakness in Oracle PeopleSoft’s “Updates Environment Management” component. If someone can reach your system over the network (via HTTP) they may be able to break in without needing an account, and then fully take control of the PeopleSoft environment. Think of it like a front-door lock that can be picked remotely—once an attacker gets in, they can change the inside settings and cause serious damage.

This matters to you if you run Oracle PeopleSoft Enterprise PeopleTools version 8.61 or 8.62, especially the “Updates Environment Management” part. Your business is at risk if your PeopleSoft system is reachable over HTTP from an attacker’s network (for example, from the internet or from an exposed network segment). Because known exploits are being used in the real world (including ransomware use), this isn’t just theoretical.

This is RED and needs urgent action because it is described as easily exploitable over HTTP and is already being used “in the wild.” Even though a public exploit isn’t available, real attackers (including a named actor in press) are exploiting this, which means you should assume attempts are plausible right now. The impact is also very high: compromise can include taking over the system and causing major harm.

Step 1: Identify whether you’re affected

• Confirm you run Oracle Corporation PeopleSoft Enterprise PeopleTools (PeopleSoft Enterprise PeopleTools) version 8.61 or 8.62.
• Confirm whether the “Updates Environment Management” component is present and enabled in your PeopleSoft deployment.
• Check whether PeopleSoft is reachable over HTTP from any untrusted network (internet-facing, VPN users from risky networks, or any segment that could be reached by an attacker).

Step 2: Patch urgently

• Apply the vendor’s patch/upgrade that addresses CVE-2026-35273 for PeopleSoft Enterprise PeopleTools 8.61/8.62.
• Plan downtime if required and prioritize any production systems exposed over HTTP.

Step 3: Temporary mitigation if patching can’t be completed right away

• Restrict HTTP access: ensure the PeopleSoft web endpoints are not reachable from the internet or other untrusted networks.
• If applicable in your setup, limit exposure to known IP ranges, use a secure reverse proxy/load balancer with strict allow-lists, and ensure HTTP is not broadly exposed.
• Reduce attack surface: ensure only necessary PeopleSoft interfaces are accessible from the allowed networks.

Step 4: Monitor and validate

• After patching, verify the service is functioning normally and that the relevant PeopleSoft endpoints/components respond as expected.
• Watch logs around web requests to PeopleSoft (especially unusual requests targeting update-related/admin/update-environment functionality) and investigate any suspicious activity from before or during the patch window.
• If your organization has incident response procedures, start preparing them (even if you do not have evidence of compromise), given that this is already being exploited.

Step 5: Confirm completion

• Record the exact PeopleSoft versions and patch levels after the change.
• Confirm network controls for HTTP access are in place and effective (from both outside and from allowed internal networks).

CVE-2026-35273 targets a vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component “Updates Environment Management,” affecting supported versions 8.61 and 8.62. The weakness is described as easily exploitable by an unauthenticated attacker with network access via HTTP, enabling compromise that can result in takeover of PeopleSoft Enterprise PeopleTools. The provided impact statement indicates confidentiality, integrity, and availability impact (rated critical with CVSS 9.8).

Exploitation status: The press information indicates “itw” (exploited in the wild) and CISA KEV lists it as known exploited, including use in ransomware. No public exploit availability is noted, and a Nuclei detection template does not exist (per the provided context).

Attack vector (from description): Remote network access over HTTP (unauthenticated, low attack complexity). This means defenders should treat exposed HTTP endpoints as high risk until patched and/or tightly restricted.

EPSS/KEV note: EPSS is given as 0.0% estimated probability in the next 30 days, but KEV status and “known exploited in the wild” indicate real-world use already observed. EPSS is an estimate and can lag or differ from observed exploitation; KEV indicates confirmed exploitation and is especially relevant for prioritization in response.