Oracle PeopleSoft CVE-2026-35273: Apply Emergency Mitigations

June 11, 2026 update: Oracle published a Security Alert for Oracle PeopleSoft CVE-2026-35273, a critical PeopleTools vulnerability affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Oracle says the issue is remotely exploitable without authentication over HTTP and may result in remote code execution.

Plain-English impact: PeopleSoft often carries HR, payroll, finance, campus, procurement, and internal operations workflows. A compromised PeopleTools environment can become a serious business-systems incident, especially when the web tier is reachable from the internet or broadly reachable from partner and remote-access networks.

BleepingComputer and SecurityWeek report active data-theft activity involving PeopleSoft environments. Oracle’s public alert does not say that Oracle has confirmed in-the-wild exploitation, so this guide separates Oracle-confirmed facts from public incident reporting and focuses on safe mitigation, exposure reduction, and review steps.

This is a protect-only guide. It keeps abuse mechanics, unsafe technical details, bypass steps, third-party target details, and lab reproduction notes out of public copy.

What is affected

The official CVE record and NVD list PeopleSoft Enterprise PeopleTools 8.61 and 8.62 as affected. Oracle’s Security Alert says PeopleSoft Enterprise Applications customers may also be affected because they rely on PeopleTools.

• Production, staging, disaster-recovery, and test PeopleSoft environments using affected PeopleTools releases.
• PeopleSoft web tiers reachable from the public internet, partner networks, VPN pools, or broad internal networks.
• Hosted PeopleSoft environments where access controls, reverse proxies, load balancers, or managed firewall rules may hide the true exposure path.
• Older PeopleSoft stacks that are out of active support and may not receive the same mitigation or patch path.

Immediate admin checklist

1. Inventory every PeopleSoft environment. Include production, nonproduction, reporting, DR, old project clones, and vendor-managed instances.
2. Confirm the active PeopleTools release. Prioritize any system running PeopleTools 8.61 or 8.62.
3. Read Oracle’s Security Alert and Patch Availability Document. Use Oracle’s PeopleSoft Security Alert documentation for the supported mitigation or patch path assigned to your release and platform.
4. Back up before changes. Take database backups, application-tier backups, web-tier config backups, and VM or storage snapshots where your platform supports them.
5. Restrict HTTP access while work is scheduled. Limit PeopleSoft web access to trusted networks, VPN, SSO access paths, and required load balancer sources. Remove direct public reachability wherever possible.
6. Apply Oracle’s mitigation or patch instructions. Follow Oracle documentation rather than third-party snippets. Record the exact PeopleTools build, mitigation status, and maintenance window.
7. Restart and verify services carefully. Validate PeopleSoft sign-in, role-specific pages, Process Scheduler, integration broker flows, reports, search, SSO, and core HR/payroll/finance workflows.

If the server was exposed

If PeopleSoft was reachable from untrusted networks before mitigation, treat the work as both a patch task and an incident review. Preserve logs before rotation, review administrator accounts and permission changes, check unexpected file changes on the web and app tiers, and look for unusual database access, exports, integrations, or report activity.

Rotate credentials tied to PeopleSoft administration, integrations, service accounts, database access, SSO, and file-transfer workflows when exposure or unusual activity is plausible. Coordinate with legal, HR, finance, compliance, and business-system owners before making customer, employee, or regulatory notifications.

Hosting and MSP notes

For hosted PeopleSoft environments, confirm whether the app is behind a CDN, WAF, reverse proxy, VPN, private access service, or load balancer. Those layers can reduce exposure, but they are not a substitute for Oracle’s mitigation or patch path. Also verify that nonproduction and DR systems are covered; older clones are often the forgotten exposure.

Communicate the maintenance window clearly. PeopleSoft patch work can affect payroll deadlines, HR self-service, procurement approvals, campus services, reporting, and integrations. Keep rollback limits realistic: once a database or PeopleTools change is made, a snapshot alone may not be enough without a tested database restore plan.

If you cannot mitigate immediately

Treat temporary controls as a short bridge. Remove direct internet access, restrict to trusted networks, pause unneeded nonproduction systems, increase monitoring, preserve evidence, and open an Oracle support path. Do not leave a vulnerable PeopleTools web tier exposed because a generic edge rule appears to be blocking suspicious traffic.

Related Fix I.T. Phill reading

• Oracle WebLogic CVE-2024-21182 CISA KEV patch guide
• Ivanti Sentry CVE-2026-10520 and CVE-2026-10523 patch guide
• Microsoft Exchange CVE-2026-42897 OWA mitigation guide
• Check Point CVE-2026-50751 VPN patch guide

Sources

• Oracle Security Alert Advisory for CVE-2026-35273
• Official CVE record for CVE-2026-35273
• NVD entry for CVE-2026-35273
• BleepingComputer report on PeopleSoft exploitation activity
• SecurityWeek report on Oracle PeopleSoft CVE-2026-35273

Need help planning a PeopleSoft emergency mitigation window? Fix I.T. Phill can help inventory exposure, coordinate backup and rollback planning, restrict access, review logs, and verify business workflows after Oracle mitigation work.