Quick Look: CVE-2026-35273, Unauthenticated RCE in Oracle PeopleSoft PeopleTools Updates Environment Management

Introduction

Oracle issued a rare out-of-cycle Security Alert on June 10, 2026 for a CVSS 9.8 unauthenticated remote code execution vulnerability in PeopleSoft Enterprise PeopleTools. Oracle reserves these alerts for flaws it considers too dangerous to wait for the next quarterly patch cycle. For the thousands of enterprises running PeopleSoft to manage payroll, HR, financials, and student records, CVE-2026-35273 is a direct path from the network to full system compromise, with no credentials required.

Technical Information

Vulnerability Overview

CVE-2026-35273 affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. This component manages environment configuration and update deployment across PeopleSoft instances. It exposes HTTP interfaces that can be reached without authentication, and those interfaces are the basis of this vulnerability.

Oracle's advisory explicitly states that successful exploitation "may result in remote code execution," and the NVD description confirms that attacks "can result in takeover of PeopleSoft Enterprise PeopleTools."

CVSS v3.1 Scoring Breakdown

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H breaks down as follows:

Taken together, these metrics describe a worst-case network vulnerability. An unauthenticated attacker can compromise the system by sending a crafted HTTP request, and nothing stands in the way of exploitation.

Probable Root Cause: Java Deserialization

Oracle does not publicly disclose the technical internals of its vulnerabilities, but the advisory references the JEP 290 Reference Blocklist Filter as an additional resource for managing related deserialization risks. JEP 290 (Filter Incoming Serialization Data) is a Java Enhancement Proposal. It provides a way to validate incoming serialized objects before they are deserialized, by specifying which classes are acceptable and which should be rejected.

That reference strongly suggests the vulnerability involves a Java deserialization attack vector. This class of vulnerability has been historically devastating in Oracle middleware products, particularly those built on WebLogic and Tuxedo, both of which underpin PeopleSoft's architecture.

PeopleSoft Architecture and Attack Surface

PeopleSoft uses a three-tier Pure Internet Architecture (PIA):

1. Web server tier: Oracle WebLogic Server
2. Application server tier: Oracle Tuxedo
3. Database tier: Oracle Database

The PeopleTools layer spans all three tiers and has historically been a high-value attack surface. The Updates Environment Management component sits within this architecture. Based on the vulnerability characteristics, it appears to accept serialized Java objects over HTTP without proper authentication or input validation.

Attack Flow

Based on the available technical details, the likely exploitation path is:

1. An attacker identifies an internet-facing or network-accessible PeopleSoft instance (common for employee self-service portals).
2. The attacker sends a crafted HTTP request to the Updates Environment Management component's endpoint.
3. The request contains a malicious serialized Java object that bypasses any existing deserialization filters.
4. The PeopleSoft application server deserializes the object, which triggers arbitrary code execution in the context of the application server process.
5. The attacker gains full control over the PeopleSoft instance, including access to all managed data (payroll, HR records, financial data) and the ability to pivot to connected database and application tiers.

No step requires authentication or user interaction, and the attack complexity is low.

Escalation Pattern in PeopleTools Vulnerabilities

CVE-2026-35273 is a notable escalation among PeopleTools vulnerabilities. Recent CVEs affecting the same versions (8.61 and 8.62) have progressively lowered the authentication barrier:

The move from low-privileged or high-privileged exploitation to fully unauthenticated exploitation is significant. It suggests either that the codebase contains multiple related vulnerability classes, or that researchers are systematically probing the same attack surfaces with increasing success.

Patch Information

Oracle addressed CVE-2026-35273 in a dedicated Security Alert released on June 10, 2026 (Revision 1). Oracle issued it as a standalone out-of-band alert rather than as part of a regularly scheduled Critical Patch Update, which is a strong signal of how seriously Oracle viewed the severity.

The fix applies to the two supported versions of PeopleSoft Enterprise PeopleTools: 8.61 and 8.62. Oracle published the patch under Patch Availability Document CPU187, accessible via My Oracle Support.

Applying the patch:

• Where to get the patch: Log into My Oracle Support and navigate to Patch Availability Document CPU187.
• How to apply: PeopleTools patches are applied with Oracle's Change Assistant tool. Select Tools, Change Actions, then Update Manager, and follow the guided workflow.
• Support coverage requirement: Oracle only provides patches for product versions covered under its Premier Support or Extended Support phases. Organizations running older, unsupported versions of PeopleTools will not receive an official fix and must upgrade to a supported release (8.61 or 8.62) before applying the patch.
• Oracle's recommendation: Treat the implementation of this patch as a "high priority risk reduction measure" and apply it without delay.

Three researchers are credited with the vulnerability: Bobby Gould and Minh Giang of TrendAI Zero Day Initiative, and Lucas Miller of TrendAI Research. The coordinated disclosure through ZDI and the resulting out-of-band alert point to the real-world exploitability of this flaw.

As a supplementary defense-in-depth measure, organizations should consider configuring JEP 290 serialization filters on PeopleSoft application server JVMs. The filters add protection against deserialization-based attacks, though they are not a replacement for the official patch. Because the attack vector is HTTP-based, restricting network access to PeopleSoft HTTP endpoints to authorized internal networks and VPN connections is also an essential interim measure.

Affected Systems and Versions

The following versions of Oracle PeopleSoft Enterprise PeopleTools are confirmed affected:

• PeopleSoft Enterprise PeopleTools 8.61
• PeopleSoft Enterprise PeopleTools 8.62

The vulnerable component is Updates Environment Management.

Oracle's advisory also notes that PeopleSoft Enterprise Applications customers may be at risk, which extends the blast radius beyond the core PeopleTools product. Any PeopleSoft deployment using PeopleTools 8.61 or 8.62 with HTTP-accessible Updates Environment Management endpoints is vulnerable.

Organizations running PeopleTools versions earlier than 8.61 are outside the scope of the official patch, but they should assume they are also affected, because Oracle's advisory warns that earlier versions are likely vulnerable.

Vendor Security History

Oracle PeopleSoft has a well-documented history of security vulnerabilities in its PeopleTools layer:

• CVE-2017-3548 (2017): An XML External Entity (XXE) vulnerability in the PeopleSoftServiceListeningConnector allowed attackers to send specially crafted unauthorized XML requests that the XML parser then processed.

• PS_TOKEN and Node Password attacks (2015): Researchers at HITB demonstrated that the PS_TOKEN cookie trust mechanism and Node password could be compromised for full system access. This research was recognized in the Top 10 Web Hacking Techniques of 2012.

• Multiple 2025 and 2026 PeopleTools CVEs: A series of vulnerabilities affecting PeopleTools 8.61 and 8.62, including CVE-2025-30697 (Panel Processor), CVE-2025-53061, CVE-2025-61750, and CVE-2026-34307 (Workflow), shows that security problems in this codebase are ongoing.

Oracle's quarterly Critical Patch Updates routinely address hundreds of vulnerabilities across its product portfolio. The May 2026 CPU alone addressed over 300. Out-of-cycle Security Alerts for PeopleSoft and enterprise application vulnerabilities are becoming more frequent (CVE-2026-21992 was another, earlier in 2026), which suggests that the standard quarterly patch cycle may not be sufficient for the pace of vulnerability discovery in Oracle's enterprise products.

On the threat actor side, the Cl0p ransomware group has recently exploited Oracle E-Business Suite vulnerabilities (including CVE-2025-61882) for account takeover and data exfiltration campaigns. That is clear precedent that sophisticated threat actors are actively targeting Oracle's enterprise application ecosystem. As of June 11, 2026, no confirmed in-the-wild exploitation of CVE-2026-35273 has been reported. CISA, however, has been actively adding Oracle vulnerabilities to the Known Exploited Vulnerabilities catalog throughout June 2026, including CVE-2024-21182 (Oracle WebLogic Server) on June 1 and three additional CVEs on June 9.

Exploitation is trivial (unauthenticated, low complexity, HTTP-based), the impact is confirmed RCE, and threat actors are actively interested in Oracle products. Together, that leaves defenders a narrow window to patch before exploitation begins.

References

• NVD: CVE-2026-35273
• Oracle Security Alert Advisory: CVE-2026-35273
• Oracle Security Blog: Security Alert CVE-2026-35273 Released
• Oracle Critical Patch Updates and Security Alerts
• Oracle Critical Security Patch Update Advisory: May 2026
• Oracle Security Alert Advisory: CVE-2026-21992
• Rublon: Oracle PeopleSoft Security: Architecture, Threats and Patch History
• HITB: Oracle PeopleSoft Applications are Under Attack (Whitepaper)
• Halcyon: Cl0p Abuses Oracle E-Business Suite for Account Takeover
• JEP 290: Filter Incoming Serialization Data
• Oracle Java Serialization Filtering Documentation
• NVD: CVE-2026-34307
• NVD: CVE-2025-53061
• NVD: CVE-2025-61750
• CISA Known Exploited Vulnerabilities Catalog
• CISA: Adds Three Known Exploited Vulnerabilities to Catalog (June 9, 2026)
• Trend Micro Threat Encyclopedia: 26-025 (June 9, 2026)
• stack.watch: Oracle PeopleSoft Enterprise PeopleTools
• Exploit-DB: Oracle PeopleSoft XML Webapps
• Oracle: Using Change Assistant to Apply PeopleTools Patch
• My Oracle Support