The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, identified as CVE-2026-35273.
This vulnerability, categorized as CWE-306 (Missing Authentication for Critical Function), allows unauthenticated attackers to gain full control of vulnerable PeopleSoft environments.
According to CISA, this flaw has been observed in ransomware campaigns, significantly increasing its risk profile and prompting accelerated remediation deadlines for affected organizations.
Oracle PeopleSoft Vulnerability
CVE-2026-35273 arises from improper enforcement of authentication in essential PeopleTools components, enabling remote attackers to bypass authentication mechanisms entirely.
Successful exploitation of this vulnerability can lead to complete system compromise, granting unauthorized access to sensitive enterprise data, executing arbitrary commands, and enabling potential lateral movement within corporate networks.
Given the widespread deployment of PeopleSoft across government agencies and large enterprises for HR, finance, and supply chain operations, the consequences of exploitation could be severe, encompassing operational disruption and large-scale data breaches.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 12, 2026, highlighting confirmed abuse by ransomware operators.
Threat actors are likely leveraging this flaw as an initial access vector, exploiting internet-facing PeopleSoft instances to deploy ransomware payloads or establish persistent access.
The rapid weaponization of this vulnerability underscores ongoing trends where attackers prioritize exploiting enterprise application flaws that provide direct access to high-value systems without requiring authentication.
Under Binding Operational Directive (BOD) 26-04, federal agencies are mandated to remediate this vulnerability by June 15, 2026, given its critical nature and active exploitation.
CISA has instructed organizations to apply vendor-provided mitigations immediately and ensure compliance with its updated risk-based patching framework.
Additionally, organizations are advised to follow CISA’s Forensics Triage Requirements to assess potential compromise, particularly if systems were exposed before patching.
Security teams are urged to evaluate all PeopleSoft deployments for internet exposure and prioritize patching or remediation accordingly. In situations where mitigations are unavailable or cannot be applied promptly, CISA recommends discontinuing the use of affected systems until they can be secured.
It is also crucial to monitor for unusual authentication patterns, unexpected administrative actions, and anomalous network traffic to detect potential exploitation attempts.
The inclusion of CVE-2026-35273 in active ransomware campaigns highlights the ongoing targeting of enterprise resource planning (ERP) platforms as high-value assets.
As threat actors increasingly exploit authentication bypass flaws to gain immediate access, organizations must adopt proactive vulnerability management strategies, enforce strict access controls, and maintain continuous monitoring to mitigate evolving threats.
CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”
