Oracle PeopleSoft Vulnerability Actively Exploited

Affected Environment

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62; predominantly universities and government entities.

Threat Overview

CVE-2026-35273 (CVSS 9.8) actively exploited; allows unauthenticated remote code execution via HTTP on PeopleSoft instances.

Exposure Timeline

Disclosed and actively exploited from June 11–12, 2026; over 100 organisations impacted across approximately 300 instances.

Attack Surface

Unauthenticated HTTP access to the Updates Environment Management Hub component exposed on the public internet.

Technical Root Cause

Management functionality exposed over HTTP without authentication in PeopleSoft’s Environment Management component.

Exploitation Pathway

Attackers POST to /PSEMHUB/hub to execute arbitrary code, deploy backdoors, and move laterally to exfiltrate data.

Operational Impact

Over 100 organisations and approximately 300 PeopleSoft instances compromised; backdoors deployed and data exfiltrated.

Strategic Impact

Universities and government entities predominantly affected; sensitive HR, financial, and student data at risk of exfiltration.

Required Mitigation

Disable or restrict PSEMHUB and HttpListeningConnector endpoints; apply Oracle patches immediately after testing.

Incident Response Guidance

Check WebLogic logs for POST requests to PSEMHUB/hub; inspect for unexpected JSP files and modified XML persistence artifacts.

References

The Hacker News – ShinyHunters exploits Oracle PeopleSoft (June 2026). Oracle Security Alert – CVE-2026-35273. SecurityWeek – Oracle addresses PeopleSoft vulnerability amid zero-day attack reports. CVE: CVE-2026-35273.

Download the Full Report

Your 24/7 Security Partner

Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.