CVE-2026-35273: Oracle PeopleSoft PeopleTools Unauthenticated RCE (KEV, ransomware)

CVE-2026-35273 is a missing-authentication flaw in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that lets a remote, unauthenticated attacker over HTTP take over the environment outright, and CISA's KEV catalog lists this CVE as having known ransomware-campaign use.

CVE-2026-35273 is a missing-authentication-for-critical-function vulnerability (CWE-306) in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, specifically the "Updates Environment Management" component. NVD's description states it is an "easily exploitable vulnerability [that] allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools," and that "successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools." Supported versions affected are 8.61 and 8.62 (NVD).

NVD lists only a Secondary CVSS v3.1 score submitted by source [email protected]: base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD's vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published, so this score is labelled not NVD-confirmed on this page (NVD).

Oracle's own Security Alert risk matrix for CVE-2026-35273 confirms the same figure independently and adds detail NVD does not carry: Protocol HTTP, "Remote Exploit without Auth.? Yes," Base Score 9.8 with sub-scores Attack Vector Network / Attack Complexity Low / Privileges Required None / User Interaction None / Scope Unchanged / Confidentiality High / Integrity High / Availability High, against Supported Versions Affected "8.61, 8.62." The alert credits the discovery to Bobby Gould, Lucas Miller and Minh Giang via the Zero Day Initiative / TrendAI Research, with an initial release date of 2026-06-10 (Oracle Security Alert).

CISA added CVE-2026-35273 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-12, with a required-action due date of 2026-06-15 — three days later — and records known ransomware-campaign use as "Known," meaning this unauthenticated-takeover flaw has been tied to actual ransomware intrusions, not merely opportunistic scanning. Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.96678 (99.884th percentile), among the highest EPSS scores in this round and consistent with an unauthenticated, network-reachable, full-compromise flaw with documented ransomware use (FIRST EPSS).

Any PeopleSoft Enterprise PeopleTools 8.61 or 8.62 environment should apply Oracle's out-of-cycle Security Alert patch for CVE-2026-35273 immediately and be reviewed for signs of prior compromise given the documented ransomware tie; because the flaw requires no authentication at all, there is no credible workaround short of patching or taking the Updates Environment Management endpoint off any untrusted network.

• Missing authentication for critical function (CWE-306) in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, allowing unauthenticated network takeover via HTTP. — NVD
• NVD lists only a Secondary CVSS v3.1 score of 9.8 (critical) from source [email protected], vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
• Oracle's Security Alert risk matrix independently confirms base score 9.8, remote exploit without authentication over HTTP, full CIA-High impact, affecting supported versions 8.61 and 8.62; credited to researchers via Zero Day Initiative/TrendAI Research, initial release 2026-06-10. — Oracle Security Alert
• Added to the CISA KEV catalog on 2026-06-12, required-action due date 2026-06-15, known ransomware campaign use recorded as Known. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
• EPSS score is 0.96678 (99.884th percentile) as of 2026-10-28. — FIRST EPSS