Back Csa.Sg

Critical Vulnerability in Oracle PeopleSoft Enterprise PeopleTools

Csa.Sg • June 12, 2026

Oracle has released security updates to address a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools that could allow unauthenticated attackers to perform remote code execution and fully compromise the affected system. Patch immediately.

Oracle has released security updates to address a critical vulnerability (CVE-2026-35273) affecting the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 9.8 out of 10.

Due to missing authentication for a critical function in Oracle PeopleSoft Enterprise PeopleTools Updates Environment Management, an unauthenticated attacker with network access via HTTP could send specially crafted requests to achieve remote code execution (RCE), potentially leading to full system compromise.

This vulnerability is reportedly being actively exploited in the wild.

The vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62.

Users and administrators of affected products are advised to update the affected products to the latest version immediately.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability A critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft has been exploited by the ShinyHunters group, leading to breaches of over 100 organizations, primarily in the education sector. The vulnerability allows unauthenticated remote code execution, enabling attackers to compromise systems without prior authentication. The exploitation occurred between May 27 and June 9, 2026, before Oracle's advisory was published on June 10, 2026. Mandiant confirmed that approximately 500,000 student records from the University of Nottingham were among the stolen data. Attackers utilized a 'gadget chain' of vulnerabilities to facilitate the breaches, and the stolen data has been published on the ShinyHunters Data Leak Site. Oracle has issued an urgent advisory recommending immediate patching and mitigation measures, but as of now, no official patch is available. Organizations are advised to restrict internet-facing access to vulnerable systems. 65 sources 77

Extracted Entities

Critical Vulnerability in Oracle PeopleSoft Enterprise PeopleTools

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)