CVE-2026-35273

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

Oracle Corporation · PeopleSoft Enterprise PeopleTools

CVSS v3.1 ORACLE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

96.68% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-06-12, used in ransomware campaigns

Nuclei

critical · CWE-502

Published

2026-06-11

Updated

2026-08-04

Proof-of-concept exploits (4)

• 0xBlackash/CVE-2026-352733★ · 2026-06-12
• HORKimhab/CVE-2026-352734★ · 2026-08-25
• 12hrformat/CVE-2026-35273-POC1★ · 2026-06-26
• ekomsSavior/POC_cve_2026_352737★ · 2026-06-13

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml

Security advisories

• https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273

References

• CVE Record
• NVD entry

Related

• CVE-2025-24132
• CVE-2025-24252
• CVE-2025-32433
• CVE-2025-36911
• CVE-2026-11405
• CVE-2026-60137