internet-facing-service-vulnerabilitywidely-deployed-product-advisoryperimeter-device-exposure

Oracle Issues Emergency Patch for Critical PeopleSoft PeopleTools RCE

Vulnerability Disclosure · 16 sources · Updated 3mo ago · First seen Jun 11, 2026

Oracle released an emergency Security Alert for CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools that affects the Updates Environment Management component. The vulnerability carries a CVSS v3.1 score of 9.8 and can be exploited remotely over HTTP without authentication or user interaction, creating a path to arbitrary code execution and potential full system compromise.

Oracle said the issue affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62, and warned that earlier or unsupported versions may also be vulnerable even if they were not formally tested. The company published patches and mitigation guidance, while external reporting said the bug was disclosed by TrendAI Zero Day Initiative researchers Bobby Gould, Lucas Miller, and Minh Giang. Organizations were urged to apply updates immediately, limit external exposure of affected systems, monitor for suspicious activity, and keep deployments on supported versions.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Jun 9, 2026 – Jun 12, 2026

Jun 12, 20265mo ago
CISA adds CVE-2026-35273 to KEV Catalog
CISA added CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools flaw, to its Known Exploited Vulnerabilities Catalog after obtaining evidence of active exploitation. The agency said the vulnerability poses significant risk to the federal enterprise and highlighted BOD 26-04 requirements for rapid remediation and compromise assessment on affected publicly exposed assets.
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
Jun 11, 20265mo ago
Trend ZDI researchers report CVE-2026-35273 to Oracle
Oracle credited TrendAI Zero Day Initiative researchers Bobby Gould, Lucas Miller, and Minh Giang with reporting CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools. The references do not provide a specific date for when the report was made.
Oracle Emergency Security Update to Fix Critical RCE Vulnerability
Jun 11, 20265mo ago
Oracle issues emergency mitigations for CVE-2026-35273
Oracle disclosed that CVE-2026-35273, a critical unauthenticated RCE in PeopleSoft PeopleTools 8.61 and 8.62, was being actively exploited and issued emergency mitigations while preparing a patch. The same reporting said ShinyHunters allegedly stole data from 300 PeopleSoft instances across more than 100 organizations.
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
Jun 11, 20265mo ago
In-the-wild exploitation of CVE-2026-35273 is reported
Help Net Security reported that CVE-2026-35273 was being exploited in the wild, citing Mandiant CTO Charles Carmakal. The report also said ShinyHunters claimed breaches of Oracle PeopleSoft servers at more than 100 organizations and identified the University of Nottingham as one confirmed victim of a related cybersecurity incident.
Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert - Help Net Security
Jun 10, 20265mo ago
Oracle issues Security Alert and patches for CVE-2026-35273
Oracle published a Security Alert for CVE-2026-35273 and released patches and mitigation guidance for the critical unauthenticated HTTP-based RCE affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62. The alert described the flaw as impacting the Updates Environment Management component and warned that unsupported earlier versions may also be affected.
Oracle Security Alert Advisory - CVE-2026-35273
Jun 9, 20265mo ago
Mandiant attributes PeopleSoft zero-day campaign to UNC6240/ShinyHunters
Mandiant reported that CVE-2026-35273 had been exploited as a zero-day between 2026-05-27 and 2026-06-09 and attributed the campaign to UNC6240, also known as ShinyHunters. The reporting said the campaign heavily targeted higher education organizations and that stolen data was posted to the ShinyHunters leak site on 2026-06-09.
Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in Oracle PeopleSoft PeopleTools Environment Management (CVE-2026-35273)

Affected products

1 linked

Peoplesoft Enterprise Peopletools

Observables

14 linked

IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••••.comURLhttps://••••••••.•••/•••••••IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

16 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Jun 17, 2026

CISA Warns of Oracle PeopleSoft 0-Day Vulnerability Exploited in Ransomware AttacksOpen source ↗

Nuclei Templates Pull RequestsNews · Jun 16, 2026

CVE-2026-35273 - Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE by DhiyaneshGeek · Pull Request #16400 · projectdiscovery/nuclei-templates · GitHubOpen source ↗

Techrepublic Com SecurityNews · Jun 15, 2026

Oracle Warns PeopleSoft Customers After Critical Zero-Day ExploitedOpen source ↗

RunzeroNews · Jun 12, 2026

Oracle PeopleSoft vulnerability: How to find impacted assetsOpen source ↗

8 additional sources from 11-06-2026 to 12-06-2026

Help Net SecurityNews · Jun 11, 2026

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert - Help Net SecurityOpen source ↗

Oracle Product AdvisoriesNews · Jun 10, 2026

Oracle Security Alert Advisory - CVE-2026-35273Open source ↗

CveAdvisories · Jan 1, 2026

CVE Record: CVE-2026-35273Open source ↗

Brazil Ctir AlertsNews · Oct 7, 2011

ALERTA 49/2026 - Gabinete de Segurança InstitucionalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilitywidely-deployed-product-advisoryperimeter-device-exposure

Oracle Issues Emergency Patch for Critical PeopleSoft PeopleTools RCE

Vulnerability Disclosure · 16 sources · Updated 3mo ago · First seen Jun 11, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Jun 9, 2026 – Jun 12, 2026

Jun 12, 20265mo ago
CISA adds CVE-2026-35273 to KEV Catalog
CISA added CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools flaw, to its Known Exploited Vulnerabilities Catalog after obtaining evidence of active exploitation. The agency said the vulnerability poses significant risk to the federal enterprise and highlighted BOD 26-04 requirements for rapid remediation and compromise assessment on affected publicly exposed assets.
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
Jun 11, 20265mo ago
Trend ZDI researchers report CVE-2026-35273 to Oracle
Oracle credited TrendAI Zero Day Initiative researchers Bobby Gould, Lucas Miller, and Minh Giang with reporting CVE-2026-35273, a critical remote code execution flaw in PeopleSoft Enterprise PeopleTools. The references do not provide a specific date for when the report was made.
Oracle Emergency Security Update to Fix Critical RCE Vulnerability
Jun 11, 20265mo ago
Oracle issues emergency mitigations for CVE-2026-35273
Oracle disclosed that CVE-2026-35273, a critical unauthenticated RCE in PeopleSoft PeopleTools 8.61 and 8.62, was being actively exploited and issued emergency mitigations while preparing a patch. The same reporting said ShinyHunters allegedly stole data from 300 PeopleSoft instances across more than 100 organizations.
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
Jun 11, 20265mo ago
In-the-wild exploitation of CVE-2026-35273 is reported
Help Net Security reported that CVE-2026-35273 was being exploited in the wild, citing Mandiant CTO Charles Carmakal. The report also said ShinyHunters claimed breaches of Oracle PeopleSoft servers at more than 100 organizations and identified the University of Nottingham as one confirmed victim of a related cybersecurity incident.
Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert - Help Net Security
Jun 10, 20265mo ago
Oracle issues Security Alert and patches for CVE-2026-35273
Oracle published a Security Alert for CVE-2026-35273 and released patches and mitigation guidance for the critical unauthenticated HTTP-based RCE affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62. The alert described the flaw as impacting the Updates Environment Management component and warned that unsupported earlier versions may also be affected.
Oracle Security Alert Advisory - CVE-2026-35273
Jun 9, 20265mo ago
Mandiant attributes PeopleSoft zero-day campaign to UNC6240/ShinyHunters
Mandiant reported that CVE-2026-35273 had been exploited as a zero-day between 2026-05-27 and 2026-06-09 and attributed the campaign to UNC6240, also known as ShinyHunters. The reporting said the campaign heavily targeted higher education organizations and that stolen data was posted to the ShinyHunters leak site on 2026-06-09.
Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in Oracle PeopleSoft PeopleTools Environment Management (CVE-2026-35273)

Affected products

1 linked

Peoplesoft Enterprise Peopletools

Observables

14 linked

IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••••.comURLhttps://••••••••.•••/•••••••IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

IPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

16 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Jun 17, 2026

CISA Warns of Oracle PeopleSoft 0-Day Vulnerability Exploited in Ransomware AttacksOpen source ↗

Nuclei Templates Pull RequestsNews · Jun 16, 2026

CVE-2026-35273 - Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE by DhiyaneshGeek · Pull Request #16400 · projectdiscovery/nuclei-templates · GitHubOpen source ↗

Techrepublic Com SecurityNews · Jun 15, 2026

Oracle Warns PeopleSoft Customers After Critical Zero-Day ExploitedOpen source ↗

RunzeroNews · Jun 12, 2026

Oracle PeopleSoft vulnerability: How to find impacted assetsOpen source ↗

8 additional sources from 11-06-2026 to 12-06-2026

Help Net SecurityNews · Jun 11, 2026

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert - Help Net SecurityOpen source ↗

Oracle Product AdvisoriesNews · Jun 10, 2026

Oracle Security Alert Advisory - CVE-2026-35273Open source ↗

CveAdvisories · Jan 1, 2026

CVE Record: CVE-2026-35273Open source ↗

Brazil Ctir AlertsNews · Oct 7, 2011

ALERTA 49/2026 - Gabinete de Segurança InstitucionalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Oracle Issues Emergency Patch for Critical PeopleSoft PeopleTools RCE

How this story unfolded

CISA adds CVE-2026-35273 to KEV Catalog

Trend ZDI researchers report CVE-2026-35273 to Oracle

Oracle issues emergency mitigations for CVE-2026-35273

In-the-wild exploitation of CVE-2026-35273 is reported

Oracle issues Security Alert and patches for CVE-2026-35273

Mandiant attributes PeopleSoft zero-day campaign to UNC6240/ShinyHunters

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

ShinyHunters Exploited Three-Flaw Oracle PeopleSoft Chain for Unauthenticated RCE

Oracle Patches 1,209 CVEs, Including Unauthenticated E-Business Suite RCE

Oracle Issues Emergency Patch for Critical PeopleSoft PeopleTools RCE

How this story unfolded

CISA adds CVE-2026-35273 to KEV Catalog

Trend ZDI researchers report CVE-2026-35273 to Oracle

Oracle issues emergency mitigations for CVE-2026-35273

In-the-wild exploitation of CVE-2026-35273 is reported

Oracle issues Security Alert and patches for CVE-2026-35273

Mandiant attributes PeopleSoft zero-day campaign to UNC6240/ShinyHunters

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

ShinyHunters Exploited Three-Flaw Oracle PeopleSoft Chain for Unauthenticated RCE

Oracle Patches 1,209 CVEs, Including Unauthenticated E-Business Suite RCE