CriticalCISA KEVExploited in the wildPublic exploit

Oracle PeopleSoft PeopleTools PSEMHUB Pre-Auth RCE

IdentifiersCVE-2026-35273CWE-306· Missing Authentication for…

CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, specifically the Updates Environment Management / Environment Management Hub (EMHub, also referenced as PSEMHUB) component, affecting supported versions 8.61 and 8.62. Oracle describes it as a missing authentication for a critical function, and multiple supporting sources state it is remotely exploitable over HTTP without authentication or user interaction. The available reporting consistently describes the issue as enabling pre-authentication remote code execution and full compromise of the PeopleSoft application infrastructure. Supporting context also places exploitation on EMHub/PSEMHUB endpoints, with references to /PSIGW/HttpListeningConnector and to a pre-auth Java deserialization RCE characterization in third-party discussion. Some reporting additionally characterizes the flaw as SSRF-related or chainable to RCE, but the most consistently supported vendor-aligned classification in the provided content is missing authentication for a critical function. Successful exploitation can result in complete takeover of the affected PeopleSoft Enterprise PeopleTools instance.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to fully compromise affected Oracle PeopleSoft Enterprise PeopleTools deployments. The provided content states impacts to confidentiality, integrity, and availability are all high, consistent with Oracle’s CVSS 3.1 score of 9.8. In observed intrusions, attackers used the flaw for initial access, remote code execution, deployment of remote management tooling, persistence, internal reconnaissance, lateral movement, theft of sensitive enterprise data, and extortion. CISA also notes known ransomware campaign use, indicating the vulnerability can be used to support full-environment compromise and disruptive follow-on activity.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or block external access to vulnerable PeopleSoft EMHub/PSEMHUB endpoints and related HTTP exposure. The provided content specifically recommends disabling the EMHub service in multi-server PeopleSoft configurations, removing the PSEMHUB application entirely in single-server deployments where feasible, and otherwise preventing internet exposure because EMHub is not required for core browser sessions. Organizations should also hunt for compromise by reviewing WebLogic and access logs for suspicious requests to PSEMHUB and /PSIGW/HttpListeningConnector, scanning for unexpected JSP files or unauthorized filesystem changes, and investigating persistence mechanisms or remote management agents deployed before patching.

Remediation

Patch, then assume compromise.

Apply Oracle’s June 2026 security fix / Critical Security Patch Update for Oracle PeopleSoft PeopleTools and Oracle PeopleSoft Enterprise Applications addressing CVE-2026-35273. Oracle’s security alert and subsequent June 2026 patch guidance in the provided content indicate customers should patch affected PeopleTools 8.61 and 8.62 on an emergency basis. Because exploitation occurred in the wild prior to disclosure, patching should be paired with incident response review to determine whether compromise already occurred before remediation.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 3 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 3 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OraclePeoplesoftapplication

OraclePeoplesoft Enterprise Peopletoolsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

274 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

274 SOURCESView more in app

thecybersecguruNews

Jun 25, 2026

ShinyHunters MSG Breach: Facial Recognition Records Leaked | The CyberSec Guru

A critical unauthenticated remote code execution zero-day in Oracle PeopleSoft PeopleTools 8.61 and 8.62 affecting the Updates Environment Management / PSEMHUB component.

cyberthroneNews

Jun 19, 2026

The Vulnerabilities That Matter in Oracle’s June 2026 CSPU - TheCyberThrone

A critical unauthenticated remotely exploitable vulnerability in Oracle PeopleSoft PeopleTools Environment Management Hub (EMHub/PSEMHUB) that Oracle says can lead to remote code execution; it was exploited as a zero-day before a patch was released.

xakepNews

Jun 18, 2026

Группировка ShinyHunters заявила, что похитила данные у компании Kodak - Хакер

A critical zero-day vulnerability in Oracle PeopleSoft reportedly used by ShinyHunters in a global campaign affecting more than 100 organizations and hundreds of PeopleSoft instances.

cyber security newsNews

Jun 17, 2026

CISA Warns of Oracle PeopleSoft 0-Day Vulnerability Exploited in Ransomware Attacks

A critical authentication bypass vulnerability in Oracle PeopleSoft Enterprise PeopleTools that allows unauthenticated remote attackers to execute critical functions and potentially take full control of affected systems.

+17 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence24

Every observed campaign linking this CVE to a named adversary.

Associated malware11

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity176

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-35273

NVD

nvd.nist.gov/vuln/detail/CVE-2026-35273

MITRE CWE · CWE-306

Missing Authentication for Critical Function

Vendor Advisory

oracle.com/security-alerts/alert-cve-2026-35273.html

Third Party Advisory

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273