CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability. Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

• CISA KEV-listed (remediation due 2026-06-15)
• used in ransomware campaigns
• EPSS 95.5% (99.9% percentile)
• CVSS 9.8 critical

Related briefings

• ShinyHunters breached universities through an Oracle PeopleSoft zero-day 2026-06-12

Linked threat actors

• ShinyHunters

Browse the CVE database

Read the full analysis on IntelFusions