CVE-2026-35273: critical flaw in PeopleSoft PeopleTools

The CVE-2026-35273 vulnerability affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, in versions 8.61 and 8.62. According to the official NVD description, it is an easily exploitable flaw allowing an unauthenticated attacker with network access via HTTP to compromise the system, with no credentials or user interaction required.

The CVSS 3.1 score is 9.8, critical range, with high impact on confidentiality, integrity and availability: a successful attack can lead to full system takeover. Published on NVD on June 11, 2026, the flaw has generated limited social discussion (6 posts in the last 24 hours) about alleged discrepancies among multiple advisories citing the same CVE; this is a community attention signal, not a verified technical fact nor confirmed active exploitation. No exploit repositories are reported in the data.

Organizations using Oracle PeopleSoft Enterprise PeopleTools should prioritize checking whether versions 8.61 or 8.62 are deployed and apply official Oracle patches as soon as available. Meanwhile, limit direct internet exposure of the component, strengthen inbound HTTP traffic controls, and monitor logs for anomalous access, given the stated ease of exploitation and lack of required authentication.