CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability. Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
- CISA KEV-listed (remediation due 2026-06-15)
- used in ransomware campaigns
- EPSS 96.7% (99.9% percentile)
- CVSS 9.8 critical
Related briefings
- ShinyHunters brought a CrowdStrike off-switch to PeopleSoft 2026-10-01
- ShinyHunters dodges WAF rules to hack unpatched PeopleSoft 2026-09-26
- ShinyHunters breached universities through an Oracle PeopleSoft zero-day 2026-06-12
Linked threat actors
- ShinyHunters machine-inferred link