CISA added CVE-2026-35273 on 12 June 2026 and describes missing authentication for a critical PeopleSoft Enterprise PeopleTools function that could permit takeover.
Key takeaways
- CISA recorded known ransomware campaign use as known for this entry.
- Locate PeopleSoft services, apply Oracle's direction, and examine access and privileged-administration activity before and after remediation.
PeopleSoft systems commonly sit near HR, finance and identity workflows. That makes an unauthenticated application weakness an enterprise-control problem, not solely a patching ticket.
This retrospective preserves the dated public record; it does not assert that any organisation using PeopleSoft was compromised.
What the sources establish
CISA's KEV record identifies CVE-2026-35273, its June addition date and a takeover consequence. Oracle's alert is the authoritative place to determine product scope and remediation.
Defensive checks
Identify exposed PeopleTools endpoints and owners, validate the vendor fix, restrict unnecessary external reachability, and retain web, authentication and administrator logs for investigation. Review privileged changes and integration accounts where exposure existed.
Sources
The right outcome is a verified remediation and a documented decision about prior-exposure review.
Editorial feedback
Have a correction or additional primary evidence? Contact the editorial team and include this article’s URL.