Vulnerabilities · 6h ago

PeopleSoft patch spans three flaws behind one CVE

Mandiant reported continued mass exploitation of Oracle PeopleSoft CVE-2026-35273 on September 25, 2026, while TrendAI’s Zero Day Initiative (ZDI) says Oracle’s single-CVE patch covers three distinct vulnerabilities. ZDI is coordinating with Oracle to assign separate CVEs for the other issues.

In one flaw, the Integration Gateway can be made to send a request back into PeopleSoft. That request passes a client check meant to restrict access to Environment Management endpoints, opening a route to remote code execution. A feature built to route messages between systems can therefore reach a restricted management function.

For PeopleSoft teams, a vulnerability inventory keyed only to the published CVE may undercount the issues covered by Oracle’s patch. Until separate identifiers are assigned, the public record does not show the full scope ZDI describes.

CVE-2026-35273

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 97% (100th percentile).

CISA federal remediation date Jun 15 · date passed

Timeline

Oct 27 Reported by Zero Day Initiative Blog
Jun 15 CISA federal deadline for CVE-2026-35273 passed
Jun 12 CVE-2026-35273 added to CISA KEV

Sources

1 source covering this story

Zero Day Initiative Blog Oct 27
Zero Day Initiative — CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group.

Entities

CVE-2026-35273
ShinyHunters

Part of the PlainSec briefing for 2026-10-27

Editions

Briefing for 2026-10-27

Vulnerabilities · 6h agoPeopleSoft patch spans three flaws behind one CVEMandiant reported continued mass exploitation of Oracle PeopleSoft CVE-2026-35273 on September 25, 2026, while TrendAI’s Zero Day Initiative (ZDI) says Oracle’s single-CVE patch covers three distinct vulnerabilities. ZDI is coordinating with Oracle to assign separate CVEs for the other issues.In one flaw, the Integration Gateway can be made to send a request back into PeopleSoft. That request passes a client check meant to restrict access to Environment Management endpoints, opening a route to remote code execution. A feature built to route messages between systems can therefore reach a restricted management function.For PeopleSoft teams, a vulnerability inventory keyed only to the published CVE may undercount the issues covered by Oracle’s patch. Until separate identifiers are assigned, the public record does not show the full scope ZDI describes.