CVE-2026-35273

What it actually does

Missing authentication on a critical function in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools (8.61 and 8.62) allows an unauthenticated attacker with HTTP network access to invoke privileged management operations. Successful abuse yields remote compromise of the PeopleTools runtime with complete loss of confidentiality, integrity, and availability (CVSS 9.8), equivalent to full application takeover rather than a limited data leak.

Why it matters to the business

PeopleSoft typically holds HR, payroll, benefits, finance, and other regulated records. Takeover enables mass PII/payroll theft, fraudulent transactions, ERP outage, and ransomware. This issue is in CISA KEV, has been used in ransomware operations, is actively exploited in the wild, and shows a very high and still-rising EPSS (0.9547 → 0.9668). Named activity includes ShinyHunters mass-exploitation and data-theft campaigns. The CISA remediation due date of 2026-06-15 is long past (published 2026-06-11; 124+ days in the wild), so remaining unpatched instances create severe regulatory, contractual, and reputational exposure.

How an attack unfolds

An attacker scans for network-reachable PeopleSoft PeopleTools 8.61/8.62 HTTP interfaces, then sends unauthenticated requests to the Updates Environment Management component. Because a critical function does not require authentication, the attacker can perform privileged environment-management actions and seize control of PeopleTools without credentials or user interaction. Observed campaigns attributed to ShinyHunters and related mass-exploitation activity use this access for large-scale data theft and, in KEV-tracked cases, as a foothold for ransomware. Follow-on activity typically includes credential harvesting from the ERP, persistence in the application/web tier, and exfiltration of HR and financial data.

How to fix it

Apply Oracle’s security update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that addresses this Updates Environment Management flaw (exact patch identifiers were not supplied with this record—use the latest Oracle CPU/Security Alert that lists CVE-2026-35273). Until patched, restrict HTTP access to PeopleTools and Environment Management interfaces to trusted management networks only; block unauthenticated internet exposure at the edge and WAF. Disable or isolate unused Environment Management services (hub/agent) where business-feasible. After patching, rotate PeopleSoft, database, and integration credentials that may have been exposed, and review Environment Management configuration for unauthorized changes.

How to confirm the fix worked

Inventory all PeopleTools 8.61/8.62 instances and confirm the Oracle patch for this CVE is installed and the application tier has been recycled per Oracle’s instructions. Verify Environment Management HTTP endpoints are not reachable from untrusted networks. Use authenticated configuration review (not exploit testing) to confirm critical Environment Management functions now require authentication. Re-scan with a vulnerability scanner that detects this CVE as a version/configuration check, and retain evidence of patch level and network controls for KEV overdue reporting.

Typical attack path

1. Discover internet- or internally reachable PeopleSoft Enterprise PeopleTools 8.61 or 8.62 HTTP services
2. Send unauthenticated HTTP requests to the Updates Environment Management component
3. Abuse the missing-authentication critical function to run privileged management operations
4. Achieve full PeopleTools takeover (code execution, configuration change, or equivalent control)
5. Steal ERP credentials and sensitive HR/payroll/finance data; optionally deploy ransomware or backdoors, consistent with ShinyHunters and KEV ransomware use

How to detect it

Assume possible prior exploitation given active-in-the-wild status, ShinyHunters mass campaigns, KEV ransomware use, and 124+ days since publication. Review PeopleSoft PIA/web server access logs and Environment Management (PSEM hub/agent) logs for unauthenticated HTTP to environment-management functions from unusual source IPs, especially bursts consistent with mass scanning. On application hosts, look for PeopleTools/Environment Management processes spawning shells or scripting interpreters, unexpected file writes under PS_HOME or PS_CFG_HOME web and class directories, new persistence (scheduled processes, web artifacts), and large outbound transfers of HR/payroll extracts. Correlate with identity logs for sudden admin activity after unauthenticated HTTP, and with DLP/egress for bulk PII exfiltration typical of ShinyHunters data theft.

• PSEMHUB
• PSEMAgent
• PSAPPSRV spawning cmd.exe
• PSAPPSRV spawning powershell.exe
• PSAPPSRV spawning bash
• PSEMHUB spawning cmd.exe
• PSEMAgent spawning /bin/sh
• unauthenticated HTTP to PeopleSoft Environment Management
• webserv/*/applications/peoplesoft/PORTAL.war unexpected JSP
• PS_CFG_HOME/webserv unexpected class file write
• PeopleSoft envmetadata unauthorized change
• large HR/payroll extract following PSEM HTTP access

What your security team should do

• Treat as overdue CISA KEV and ransomware-associated: patch or isolate every PeopleTools 8.61/8.62 instance immediately
• Remove internet and untrusted-network exposure of PeopleSoft PIA and Updates Environment Management HTTP interfaces
• Hunt for ShinyHunters-style data theft and post-takeover activity on PeopleSoft hosts before and after patching
• Rotate PeopleSoft, database, SSO, and integration secrets; review privileged ERP accounts for unauthorized use
• Preserve web, application, and Environment Management logs and run the detection guidance below
• If compromise is confirmed, invoke incident response, assume ERP data exposure, and assess ransomware staging