Vulnerability intelligence

CVE-2026-35273

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Score

9.8

Critical

EPSS — Exploit Probability

94%

Riskier than 100% of all CVEs

Exploitation

Confirmed in the wild

KEV since 2026-06-12

Remediation

Patch available

Federal deadline 2026-06-15

NVD entry Vendor patch PoC / advisory CISA KEV

18 articles across 11 outlets · first covered Jun 11, 2026 · latest Jun 30, 2026

Tracked incidents

vulnerability open 33 articles

Oracle PeopleSoft zero‑day flaw CVE-2026-35273 exploited in higher education attacks

Associated threat actors

Coverage timeline

Codex Rate Limit Reset: OpenAI Introduces Flexible Limits
securityonline.info · Jun 15, 2026
CVE-2026-35273 flaw lets attackers wipe Wazuh logs via PeopleSoft
securityonline.info · Jun 15, 2026
UEFI shim bug CVE-2026-35273 enables Secure Boot bypass
securityonline.info · Jun 15, 2026
CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273
securityaffairs.com · Jun 13, 2026
CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog
www.cisa.gov · Jun 12, 2026
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed
www.darkreading.com · Jun 12, 2026
CISA Flags CVE-2026-35273 in PeopleSoft, Orders Patch by June 15
cisa.gov · Jun 12, 2026
ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis
arstechnica.com · Jun 12, 2026
CISA flags Oracle PeopleSoft bug CVE-2026-35273 in KEV catalog
www.cisa.gov · Jun 12, 2026
ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide
databreaches.net · Jun 12, 2026
Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
www.rapid7.com · Jun 12, 2026
CVE-2026-35273 flaw used in ShinyHunters attack on universities
securityaffairs.com · Jun 12, 2026
ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham
www.securityweek.com · Jun 12, 2026
ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273
securityonline.info · Jun 12, 2026
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
thehackernews.com · Jun 11, 2026
ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw
cloud.google.com · Jun 11, 2026
Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw
www.securityweek.com · Jun 11, 2026
Oracle warns of critical PeopleSoft RCE flaw CVE-2026-35273
securityonline.info · Jun 11, 2026