CVE-2026-35273

This vulnerability is a weakness in Oracle PeopleSoft’s “Updates Environment Management” component. If someone can reach your system over the network (via HTTP) they may be able to break in without needing an account, and then fully take control of the PeopleSoft environment. Think of it like a front-door lock that can be picked remotely—once an attacker gets in, they can change the inside settings and cause serious damage.

This matters to you if you run Oracle PeopleSoft Enterprise PeopleTools version 8.61 or 8.62, especially the “Updates Environment Management” part. Your business is at risk if your PeopleSoft system is reachable over HTTP from an attacker’s network (for example, from the internet or from an exposed network segment). Because known exploits are being used in the real world (including ransomware use), this isn’t just theoretical.

This is RED and needs urgent action because it is described as easily exploitable over HTTP and is already being used “in the wild.” Even though a public exploit isn’t available, real attackers (including a named actor in press) are exploiting this, which means you should assume attempts are plausible right now. The impact is also very high: compromise can include taking over the system and causing major harm.