cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Oracle Issues PeopleSoft Mitigations for Critical RCE Vulnerability Amid Exploitation Reports

· Original article ↗

Summary

Oracle issued an out-of-band alert for critical PeopleSoft RCE vulnerability CVE-2026-35273, affecting PeopleTools 8.61 and 8.62, and recommended mitigations. Oracle did not confirm exploitation; a TrendAI researcher reported limited exploitation.

Key points

  • CVE-2026-35273 can reportedly enable unauthenticated remote code execution in affected PeopleSoft environments.
  • Oracle says PeopleTools versions 8.61 and 8.62 are affected; users of PeopleSoft Enterprise Applications could also be impacted.
  • Oracle released recommended mitigations rather than a full patch and urged immediate action.
  • Oracle did not confirm in-the-wild exploitation. TrendAI's Dustin Childs said limited exploitation was being observed and its investigation was ongoing.
  • Hackers claiming affiliation with ShinyHunters said they targeted 300 PeopleSoft instances across more than 100 organizations and claimed to have chained old and zero-day vulnerabilities to access data.
  • Bleeping Computer reported that education was the hardest-hit sector; the University of Nottingham confirmed a significant data breach.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
Severity
Critical
Affected Versions
  • PeopleSoft Enterprise PeopleTools 8.61
  • PeopleSoft Enterprise PeopleTools 8.62
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
partial

CVE

CVE-2026-35273Oracle Corporation · PeopleSoft Enterprise PeopleToolsThe newly disclosed vulnerability is tracked as CVE-2026-35273, and Oracle says it’s a critical issue that affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62.

People

Charles CarmakalMandiant CTO who warned about zero-day exploitation.Dustin ChildsTrendAI's Head of Threat Awareness; he reported limited exploitation while noting that the investigation was ongoing.

Threat Actors

ShinyHuntersHackers claiming affiliation with ShinyHunters said they targeted 300 PeopleSoft instances at more than 100 organizations and chained old and zero-day vulnerabilities to access data. The article reports that the attacks appeared to be confirmed by a researcher; the affiliation and claims are not presented as independently confirmed.

Vendors

OracleOracle on Thursday released an out-of-band advisory addressing a PeopleSoft vulnerability that can be exploited by an unauthenticated attacker for remote code execution.TrendAITrendAI researchers have been credited by Oracle for reporting the vulnerability.

Products

PeopleSoftOracle on Thursday released an out-of-band advisory addressing a PeopleSoft vulnerability that can be exploited by an unauthenticated attacker for remote code execution.PeopleSoft Enterprise ApplicationsPeopleSoft Enterprise Applications users could also be impacted.PeopleSoft Enterprise PeopleToolsThe newly disclosed vulnerability is tracked as CVE-2026-35273, and Oracle says it’s a critical issue that affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62.

Industries

EducationBleeping Computer reported that the education sector was hit the hardest, and the University of Nottingham is one of the victims.

Related Articles