CVE-2026-35273: listed in the CISA KEV catalog

CVE-2026-35273 · CVSS 9.8 CRITICAL · EPSS 95% · KEV 2026-06-12

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Is CVE-2026-35273 exploited?

• Listed in the CISA KEV catalog on 2026-06-12.
• Federal remediation due 2026-06-15.
• Past that date by 61 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 95%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-35273

• Internet-Facing PeopleSoft Console Becomes Extortion Foothold (2026-06-25)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.