Active Exploitation of Oracle PeopleSoft PeopleTools Missing Authentication (CVE‑2026‑35273) Threatens Enterprise ERP
What It Is — Oracle PeopleSoft Enterprise PeopleTools contains a missing‑authentication flaw in a critical function, allowing an unauthenticated attacker to execute arbitrary actions with full system privileges. The vulnerability (CVE‑2026‑35273) has been confirmed as actively exploited in the wild.
Exploitability — CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation and public‑facing payloads. A proof‑of‑concept exists, and the CVSS base score is estimated at 9.8 (Critical).
Affected Products — Oracle PeopleSoft Enterprise PeopleTools (all supported versions as of June 2026).
TPRM Impact — Organizations that rely on PeopleSoft for finance, HR, or supply‑chain processes face a direct pathway for credential‑less compromise, potentially exposing sensitive business data and disrupting critical back‑office operations across multiple industries.
Recommended Actions —
- Prioritize patching of PeopleTools per Oracle’s advisory and CISA BOD 26‑04 guidance.
- Conduct an inventory of all publicly exposed PeopleSoft instances; apply immediate network segmentation or block external access where patching is delayed.
- Verify that the vulnerability has not been leveraged in your environment by reviewing relevant IDS/IPS logs and endpoint telemetry.
- Document remediation status to satisfy federal BOD reporting requirements and internal risk‑management frameworks.
Source: CISA Advisory – June 12 2026