Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution Vulnerability

The Digital Security Authority (DSA) wants to bring to your attention a critical-severity vulnerability, CVE-2026-35273, affecting Oracle PeopleSoft Enterprise PeopleTools. The vulnerability involves missing authentication / server-side request forgery (SSRF) within the Updates Environment Management component, which can be exploited to achieve unauthenticated remote code execution on target instances.

A critical-severity vulnerability, CVE-2026-35273 , has been identified in Oracle PeopleSoft Enterprise PeopleTools. The issue affects the Updates Environment Management component, specifically targeting the PeopleSoft Environment Management Hub (/PSEMHUB/hub) and Integration Gateway endpoints (/PSIGW/HttpListeningConnector). Unauthenticated network attackers can send specially crafted HTTP POST requests to achieve arbitrary file writes and execute arbitrary commands on vulnerable PeopleSoft applications. Active zero-day exploitation in the wild by threat groups (including UNC6240 / ShinyHunters) has been observed.

Vulnerability Details

• CVE ID: CVE-2026-35273 • Severity: Critical • Vulnerability Type: Command Injection / Special Elements Injection • Affected Components: Missing Authentication for Critical Function (CWE-306) / Server-Side Request Forgery (SSRF) leading to Remote Code Execution • Affected Platforms: Updates Environment Management • Attack Vector: Network / Remote over HTTP • Authentication Required: None • User Interaction: None • Root Cause: Lack of authentication checks on Environment Management Hub HTTP endpoints combined with unsafe processing of incoming requests • Exploitation Requirements: Network reachability to the RouterOS SSH interface (typically port 22); public exposure significantly increases risk • Impact: Unauthenticated Remote Code Execution, full system takeover, potential data exfiltration of sensitive HR, financial, or personnel records • Exploitation Status: Active zero-day exploitation in the wild confirmed (Added to CISA Known Exploited Vulnerabilities) • Risk Level: Critical

Vulnerable Configurations Versions: • Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

Apply the Security Alert patches provided by Oracle immediately to address the vulnerability in PeopleTools. If patches cannot be applied immediately, restrict access or disable the Environment Management Hub (PSEMHUB) services.

The Digital Security Authority (DSA) recommends updating software immediately and enforcing network isolation.

• Upgrade: Apply Oracle's official security patches for PeopleTools versions 8.61 and 8.62. • Network Isolation: Block external and untrusted access to /PSEMHUB/* and /PSIGW/HttpListeningConnector endpoints at the firewall/reverse proxy level. • Disable Unused Services: Disable the Environment Management Hub (EMHub) Service in multiserver setups or remove the PSEMHUB web application in single-server environments if not required. • Monitoring & Hunting: Inspect web application logs for unexpected HTTP POST requests directed at /PSEMHUB/hub or /PSIGW/HttpListeningConnector, check for suspicious.jsp file creations under the web server directory, and monitor outbound SMB traffic (TCP port 445) from PeopleSoft servers.

Please ensure to distribute this information among your subsidiaries and partners and provide us with any pertinent information or findings you may have (such as Indicators of Compromise, Tactics, Techniques, and Procedures, etc.).

The Digital Security Authority (DSA) extends its appreciation for the continued collaboration.

The information presented in this report is based on available data up to the 23rd of September 2026.

Download the report in .pdf