Critical Remote Code Execution in Oracle PeopleSoft PeopleTools (CVE‑2026‑35273) Added to CISA KEV Catalog
What It Is – Oracle PeopleSoft Enterprise PeopleTools contains a critical remote‑code‑execution flaw (CVE‑2026‑35273) in the Environment Management component. The vulnerability requires no authentication or user interaction; an attacker with network access to the Environment Management Hub can execute arbitrary code on the server.
Exploitability – Actively exploited as a zero‑day by the UNC6240 (ShinyHunters) group. Public advisories appeared only after the campaign was observed. CVSS 9.8 (Critical).
Affected Products – Oracle PeopleSoft PeopleTools 8.61, 8.62 and likely earlier unsupported versions. The platform underpins PeopleSoft ERP, HCM, and campus‑wide applications.
TPRM Impact – Organizations that outsource ERP, HR, or campus services to vendors running PeopleTools face immediate risk of server takeover, data loss, and extortion. The flaw can cascade through supply‑chain relationships, exposing downstream partners and customers.
Recommended Actions –
- Apply Oracle’s advisory patches immediately for all PeopleTools instances.
- If patching is not yet possible, block inbound traffic to the Environment Management Hub (default ports 443/8443) at the perimeter and enforce network segmentation.
- Deploy IDS/IPS signatures for CVE‑2026‑35273 and monitor for anomalous HTTP traffic on port 8888 or related staging infrastructure.
- Conduct a rapid inventory of all third‑party services that rely on PeopleSoft and verify their remediation status.
- Review and update incident‑response playbooks to include zero‑day RCE scenarios for ERP platforms.
Source: SecurityAffairs – CISA adds Oracle PeopleSoft PeopleTools flaw to KEV catalog