Oracle PeopleSoft PeopleTools: missing-authentication flaw (CVE-2026-35273) exploited in the wild
Published 30/10/2026 10:28
Timeline
3 events over 8 d
- 21/10/2026 14:33ConfirmedNCSC-NL advisories+6 d 23 h
- 28/10/2026 13:19Exploitedcisa.gov+1 d 21 h
- 30/10/2026 10:28Published on WatchtowerPro CISO
In short
CVE-2026-35273 is a critical missing-authentication flaw (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, with a CVSS score of 9.8. CISA added it to its Known Exploited Vulnerabilities catalog on 12/06/2026 on evidence of active exploitation. Fixed versions and patch numbers for PeopleTools are not yet known. GreyNoise reports a public exploit for CVE-2025-61882; listed by CISA as known exploited (30/10/2026).
How bad is it
Critical. An attacker who can reach a vulnerable PeopleSoft server over the network can use a function that lacks any login check, without needing an account or any user action.
Being exploited - on CISA's known-exploited list since 06/10/2025.
Severity score
The worst of 2 CVEs · CVSS 3.1 from NVD, from oracle.com, read 30/10/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: authentication bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (CVE-2026-35273), per INCIBE-CERT quoting NVD.
- Oracle E-Business Suite 12.2.3-12.2.14 (CVE-2025-61882), per the GitHub Advisory Database copy of Oracle's text.
- NCSC-NL's E-Business Suite advisory covers versions 12.2.3 to 12.2.15 for the 194 flaws Oracle fixed.
What to do now
- Install Oracle's patches for CVE-2026-35273 (PeopleTools 8.61 and 8.62) and CVE-2025-61882 (E-Business Suite 12.2.3-12.2.14) as soon as the correct patch numbers are confirmed in Oracle's alerts and My Oracle Support.
- Until patched, check whether PeopleSoft and E-Business Suite web tiers are reachable from the internet and restrict access to a VPN or allow-list, or put them behind a reverse proxy or WAF. These interim measures reduce exposure and do not make a server safe.
- Assume a system may already be compromised if it was exposed and unpatched, and look for signs of compromise.
- Do not run public exploit or scanner code from GitHub against production systems.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run Oracle E-Business Suite, at which version, fixed or not - and what each one needs.
Main sources
NCSC-2026-0442 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle E-Business Suite CERT · Known Exploited Vulnerabilities Catalog | CISA CERT · Hackers now scanning systems for recently-patched Oracle flaw Research