Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 15 Jun 2026.Known ransomware use
In the wildRansomwareHigh EPSSRemotely reachableNo privilegesZero-click
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidence
Critical unauthenticated remote code execution vulnerability in PeopleSoft Enterprise PeopleTools Updates Environment Management component. The flaw allows remote attackers with network access via HTTP to execute arbitrary code without any credentials, achieving complete system compromise including full confidentiality, integrity, and availability impacts.
MitigationApply Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 when available. Until then, restrict network access to Updates Environment Management interfaces, implement WAF rules, or disable the component if not required.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Peoplesoft Enterprise PeopletoolsApplication
Affected:= 8.61= 8.62
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Identify PeopleTools version
Log into PeopleSoft Application Designer or check the PS_HOME directory for the version file. Alternatively, access the PeopleSoft sign-in page and check the version information typically displayed in the footer or via the About page.
Affected if The displayed version is exactly 8.61 or 8.62.
Locate the Updates Environment Management component
Navigate to PeopleSoft Enterprise Portal and locate the Updates or Environment Management module. This is typically found under Enterprise Components > Updates or similar navigation paths within the PeopleSoft portal interface.
Affected if The Updates Environment Management component is present and accessible in the PeopleSoft navigation menu.
Verify HTTP accessibility of PeopleSoft interfaces
Check which HTTP ports are open and listening for the PeopleSoft web cluster (usually ports like 8000, 8080, or 443). Use netstat or similar network tools to identify exposed listeners.
Affected if The PeopleSoft HTTP interfaces are reachable over the network on standard HTTP/HTTPS ports.
Confirm unauthenticated access to Updates component
Attempt to access the Updates Environment Management URL directly without providing credentials. Common paths include /psc/ps/EMPLOYEE/HRMS/c/UPGRADE/... or similar patterns. Observe whether the component loads without authentication.
Affected if The Updates Environment Management component loads or responds to unauthenticated HTTP requests.
You are affected if your PeopleTools version is exactly 8.61 or 8.62 AND the Updates Environment Management component is accessible via HTTP without authentication.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Mitigation availableNo clean upgrade yet — mitigate in the meantime
Mitigation
Apply Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 when available. Until then, restrict network access to Updates Environment Management interfaces, implement WAF rules, or disable the component if not required.
Recommended fixModerate confidence
Apply Oracle Critical Patch Update containing the fix for CVE-2026-35273 (contact Oracle for specific patch number)
Check Oracle's official Critical Patch Update (CPU) advisory for the applicable quarter to obtain the specific patch for this vulnerability
Contact Oracle PeopleSoft support to confirm the exact patch number for CVE-2026-35273
Apply the Oracle CPU patch following Oracle's standard patch application process for PeopleTools
After patching, verify the Updates Environment Management component no longer accepts unauthenticated requests
Confirm the patch was applied successfully by reviewing PeopleTools version information
Caveat Oracle CPU patches typically include cumulative fixes; review patch notes for any configuration or compatibility considerations
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Peoplesoft Enterprise Peopletools
Exploited in the wild — priority engagement
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $15,232.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-35273 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 82%2 agents9 Aug 2026
CVE-2026-35273 is a critical vulnerability in PeopleSoft's Updates Environment Management component with a CVSS 9.8 and active exploitation confirmed by CISA KEV inclusion and an EPSS score of 0.95473. The vulnerability is exploitable without authentication, which is the core problem you need to address immediately.
This component handles update packages, configuration changes, and file operations with elevated privileges within the PeopleSoft environment. That it's unauthenticated means anyone who can reach the network path can trigger it—there's no login page to bypass because none exists. This isn't unusual for infrastructure code; update and management endpoints often inherited implicit trust from an era when they ran on isolated internal networks. Those assumptions have not survived the transition to hybrid and cloud deployments.
Your immediate actions: First, verify whether any PeopleSoft interfaces—particularly /envmgr or similar update-related paths—are exposed to the internet. If they are, block them at the network layer immediately; don't wait for the patch. Second, check your Oracle Critical Patch Updates for CVE-2026-35273 and apply the corresponding security patch within your SLA for critical vulnerabilities—this is a known actively exploited flaw, so your SLA should be measured in days, not weeks. Third, review other management and diagnostic endpoints in your PeopleSoft deployment for similar unauthenticated exposure; the pattern of exploited PeopleSoft vulnerabilities consistently targets these interfaces.
The structural lesson: infrastructure code receives less security scrutiny than user-facing interfaces, but it operates with elevated privileges and fewer restrictions. Your threat model must treat management, update, and diagnostic endpoints as potentially internet-facing attack surface regardless of their intended deployment context.
Peer-ranked notes from engineers who’ve handled CVE-2026-35273 in production — separate from our analysis above.
Know something about CVE-2026-35273?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
CVE-2026-35273 is a critical vulnerability in PeopleSoft's Updates Environment Management component with a CVSS 9.8 and active exploitation confirmed by CISA KEV inclusion and an EPSS score of 0.95473. The vulnerability is exploitable without authentication, which is the core problem you need to address immediately.
This component handles update packages, configuration changes, and file operations with elevated privileges within the PeopleSoft environment. That it's unauthenticated means anyone who can reach the network path can trigger it—there's no login page to bypass because none exists. This isn't unusual for infrastructure code; update and management endpoints often inherited implicit trust from an era when they ran on isolated internal networks. Those assumptions have not survived the transition to hybrid and cloud deployments.
Your immediate actions: First, verify whether any PeopleSoft interfaces—particularly /envmgr or similar update-related paths—are exposed to the internet. If they are, block them at the network layer immediately; don't wait for the patch. Second, check your Oracle Critical Patch Updates for CVE-2026-35273 and apply the corresponding security patch within your SLA for critical vulnerabilities—this is a known actively exploited flaw, so your SLA should be measured in days, not weeks. Third, review other management and diagnostic endpoints in your PeopleSoft deployment for similar unauthenticated exposure; the pattern of exploited PeopleSoft vulnerabilities consistently targets these interfaces.
The structural lesson: infrastructure code receives less security scrutiny than user-facing interfaces, but it operates with elevated privileges and fewer restrictions. Your threat model must treat management, update, and diagnostic endpoints as potentially internet-facing attack surface regardless of their intended deployment context.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data