CVE-2026-35273: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-35273 Overview

CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component. Supported versions 8.61 and 8.62 are affected. The flaw allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation results in full takeover of the affected PeopleTools instance, impacting confidentiality, integrity, and availability.

Critical Impact
Unauthenticated remote attackers can take over Oracle PeopleSoft Enterprise PeopleTools deployments over the network using HTTP, with no user interaction required.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Component: Updates Environment Management

Discovery Timeline

2026-06-11 - CVE-2026-35273 published to NVD
2026-06-11 - Last updated in NVD database
2026-06-11 - Oracle Security Alert published for CVE-2026-35273

Technical Details for CVE-2026-35273

Vulnerability Analysis

The vulnerability resides in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated attacker can reach the vulnerable HTTP-facing functionality over the network. Oracle classifies the issue as easily exploitable, meaning no advanced conditions are required to trigger it.

Successful exploitation leads to complete takeover of PeopleTools, granting the attacker the ability to read sensitive enterprise data, modify application logic, and disrupt availability. Because PeopleTools underpins HCM, FSCM, and Campus Solutions deployments, compromise can cascade into HR records, financial transactions, and student data. Oracle's advisory does not enumerate the underlying weakness class, but the unauthenticated network-reachable HTTP behavior is consistent with input handling or authentication bypass flaws in the Environment Management framework.

Root Cause

Oracle has not disclosed the specific root cause in the public security alert. The Updates Environment Management subsystem manages communication between PeopleSoft clients and the Environment Management Hub over HTTP. Insufficient validation or missing authentication on these HTTP endpoints is the most likely root cause based on the published attack profile.

Attack Vector

The attack vector is the network. An attacker sends crafted HTTP requests to the Environment Management interface exposed by PeopleTools. No credentials are required, and no user interaction is needed. Organizations exposing PeopleSoft Environment Management endpoints to untrusted networks face the highest risk.

No public proof-of-concept code has been released. Refer to the Oracle Security Alert CVE-2026-35273 for vendor-provided technical details.

Detection Methods for CVE-2026-35273

Indicators of Compromise

Unexpected HTTP requests targeting PeopleSoft Environment Management endpoints from external or non-administrative source IPs.
New or modified PeopleTools application files, scheduled processes, or administrative accounts on PeopleSoft application servers.
Outbound connections from PeopleSoft application or web server tiers to unknown hosts following inbound HTTP traffic to Environment Management URLs.

Detection Strategies

Inspect web server and application server access logs for anomalous URI patterns referencing Environment Management or PSEMHUB resources.
Correlate authentication and process execution telemetry on PeopleSoft hosts with inbound HTTP traffic to identify post-exploitation activity.
Deploy network signatures that flag unauthenticated HTTP requests to PeopleTools management endpoints from untrusted segments.

Monitoring Recommendations

Forward PeopleSoft web, application, and process scheduler logs to a centralized SIEM for retention and correlation.
Alert on creation of new operator IDs, role grants, or PeopleCode changes outside change-management windows.
Monitor for unusual child processes spawned by PeopleSoft service accounts, including shell, scripting, or download utilities.

How to Mitigate CVE-2026-35273

Immediate Actions Required

Apply the Oracle security update referenced in the Oracle Security Alert CVE-2026-35273 to PeopleTools 8.61 and 8.62 deployments.
Restrict network access to PeopleSoft Environment Management endpoints so they are reachable only from trusted administrative networks.
Audit PeopleSoft application servers for indicators of compromise prior to and after patching.

Patch Information

Oracle published a security alert for CVE-2026-35273 on 2026-06-11. Administrators should review the Oracle Security Alert CVE-2026-35273 and apply the fixes provided for PeopleTools 8.61 and 8.62. Out-of-cycle alerts from Oracle indicate the vendor considers immediate patching necessary.

Workarounds

Block external access to Environment Management HTTP endpoints at the perimeter and reverse proxy layer until patches are applied.
Place PeopleSoft management interfaces behind a VPN or zero-trust network access gateway requiring authenticated administrative sessions.
Disable or isolate the Environment Management Hub on internet-facing PeopleTools instances if it is not required for current operations.

bash

# Example: restrict Environment Management endpoints at the web tier
# Apache HTTP Server (PeopleSoft PIA) - allow only trusted admin subnet
<LocationMatch "^/(PSEMHUB|psemhub)">
    Require ip 10.10.20.0/24
    Require all denied
</LocationMatch>