Oracle PeopleSoft PeopleTools missing authentication allows unauthenticated takeover
Oracle PeopleSoft Enterprise PeopleTools contains a missing-authentication flaw. Unauthenticated attackers can obtain full takeover. CVSS 9.8, KEV-listed, known ransomware use confirmed.
- Vendor
- Oracle
- Product
- PeopleSoft Enterprise PeopleTools
- CVSS
- 9.8
- EPSS (exploit probability)
- 9.4%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-35273 is a missing-authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools that allows unauthenticated network access to complete takeover of the system. Oracle rated it CVSS 9.8 critical. CISA added it to the Known Exploited Vulnerabilities catalog on June 12, 2026, with a June 15 remediation deadline for federal agencies under BOD 26-04. Known ransomware use is confirmed per CISA.
Active exploitation continued beyond the initial KEV window. In September 2026, ShinyHunters was confirmed using a URL-encoding trick to bypass WAF rules deployed as a compensating control, allowing the group to maintain access to systems with mitigations in place but the patch not applied. See ShinyHunters WAF Bypass Keeps PeopleSoft Attacks Alive for coverage.
Remediation: apply Oracle’s patch per the NVD advisory. WAF rules alone are insufficient since URL encoding bypasses known WAF signatures. Audit any system in the exploitation window for web shells before closing the ticket.
