CVE-2026-35273

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

95.47% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-06-12, used in ransomware campaigns

Nuclei

critical · CWE-502

Published

2026-06-11

Updated

2026-08-04

Proof-of-concept exploits (4)

• 0xBlackash/CVE-2026-352732★ · 2026-06-12
• HORKimhab/CVE-2026-352734★ · 2026-08-25
• 12hrformat/CVE-2026-35273-POC0★ · 2026-06-26
• ekomsSavior/POC_cve_2026_35273

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-24132
• CVE-2025-24252
• CVE-2025-32433
• CVE-2025-36911
• CVE-2026-11405
• CVE-2026-60137