Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-35273

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

9.8
CVSS 3.1
1
story
JUN 12
added to KEV
Severity
9.8 Critical · vendor score
Vendor
Oracle
Product
PeopleSoft Enterprise PeopleTools
Published
Jun 11, 2026
Added to KEV
Jun 12, 2026
KEV deadline
Jun 15, 2026
Ransomware use
Known
Weakness
CWE-306

What it is

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesOracle Zero-Day Linked to Latest ShinyHunters Attacks“Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day,” said Mandiant researchers.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryoracle.com/security-alerts/alert-cve-2026-35273.html