Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)

1. Apply Official Security Patches

Refer to the Oracle Security Advisory to apply the latest Critical Patch Update (CPU) immediately.

• Oracle Security Advisory

2. Temporary Mitigations

If patching cannot be applied immediately, implement the following workarounds:

A. Network Access Control (ACL)

Restrict direct HTTP/HTTPS access to the PeopleSoft web servers from the public internet. Ensure access is only permitted via trusted internal IP ranges or secure VPN connections.

B. Web Application Firewall (WAF) Rules

Configure WAF rules to block unauthorized or anomalous HTTP requests targeting the Updates Environment Management endpoints.

# Example Nginx Reverse Proxy configuration to restrict access to the management path
location /ps/UpdatesEnvironmentManagement {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

A critical vulnerability (CVE-2026-35273) has been identified in the 'Updates Environment Management' component of Oracle PeopleSoft Enterprise PeopleTools. The root cause is the missing authentication for a critical function (CWE-306), which allows an unauthenticated attacker with network access via HTTP to compromise the system.

With a CVSS 3.1 Base Score of 9.8, this vulnerability is highly exploitable due to low attack complexity and zero requirement for privileges or user interaction. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, with an EPSS score of 0.94, indicating an extremely high risk of immediate exploitation.