CVE-2026-35273

Published Jun 11, 2026

Last updated 3 months ago

Zero-day

Database

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-35273 is a remote code execution (RCE) vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component, also known as the Environment Management Hub (PSEMHUB). This flaw allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools without requiring user interaction. Successful exploitation can lead to a complete takeover of the affected system. The vulnerability impacts PeopleTools versions 8.61 and 8.62, with earlier unsupported versions also likely susceptible. It was actively exploited as a zero-day by the ShinyHunters extortion crew (tracked as UNC6240 by Mandiant) between May 27 and June 9, 2026, prior to Oracle's advisory on June 10. The attacks primarily targeted universities and leveraged missing authentication checks in PSEMHUB HTTP endpoints to execute arbitrary code through crafted POST requests to `/PSEMHUB/hub` or `/PSIGW/HttpListeningConnector`.

Description: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Source: secalert_us@oracle.com
NVD status: Analyzed
Products: peoplesoft_enterprise_peopletools

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Exploit added on: Jun 12, 2026
Exploit action due: Jun 15, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*",
            "matchCriteriaId": "18F15FC6-947A-462A-8329-C52907799A7C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*",
            "matchCriteriaId": "FF0E4EFC-096B-4861-8D55-D8DAA37A21E9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.