Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since June 12, 2026.
CVE-2026-35273
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle · PeopleSoft Enterprise PeopleTools
Added to KEV June 12, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-35273
- CWE
- CWE-306
- Affected products
- PeopleSoft Enterprise PeopleTools · Oracle PeopleSoft Enterprise PeopleTools · Oracle
What happened
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
What it means for your business
Oracle PeopleSoft Enterprise PeopleTools is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-35273). Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. CISA remediation due date: 2026-06-15. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: June 15, 2026
Sources
Related briefs
Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle E-Business Suite is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-46817). Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CISA remediation due date: 2026-07-18. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Oracle E-Business Suite is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-61884). Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. CISA remediation due date: 2025-11-10. If you need help checking exposure, call (864) 335-9223.
Oracle E-Business Suite Unspecified Vulnerability
Oracle E-Business Suite is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-61882). Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing. CISA remediation due date: 2025-10-27. If you need help checking exposure, call (864) 335-9223.
Oracle E-Business Suite Unspecified Vulnerability
Oracle E-Business Suite is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-21587). Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. CISA remediation due date: 2023-02-23. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.