The vulnerability CVE-2026-35273 in the Oracle PeopleSoft platform (PeopleTools 8.61 and 8.62) went from a "serious warning" to an emergency in a few hours: CISA included it in the Known Exploited Vulnerabilities (KEV) list, which practically means that there are reliable indications of active exploitation and that organizations must act immediately.
Why CVE-2026-35273 is so dangerous
According to the available technical descriptions, the vulnerability is located in the Updates Environment Management component of PeopleSoft PeopleTools and can be exploited remotely without authentication, leading to takeover/remote code execution application-level. In “real-world” terms, this means: if a PeopleSoft environment is exposed to the internet or untrusted networks, an attacker can gain access and set up persistence before the IT team even has time to notice.
See also: CISA to federal agencies: Fix critical vulnerabilities within 72 hours
The twist that raises the "temperature"
The story is not just “another critical CVE.” Google (via GTIG/Mandiant) and related reports attribute exploitation activity to a group linked to data theft/extortion (referred to as ShinyHunters/UNC6240), with observed exploitation prior to Oracle’s out-of-band announcement/guidance. In other words: for a few days, the bug operated as a zero-day.
The key points that admins need to know (the "2 endpoints")
Several technical analyses converge that the exploit focuses on specific web endpoints, with particular attention to:
– /PSEMHUB/hub
– /PSIGW/HttpListeningConnector
The important thing here is that defense is not theoretical. There are specific "exposure reduction" moves you can implement even before full patching.
Mitigations / immediate steps (before and in parallel with patching)
1) Reduce network exposure immediately
– Unless absolutely necessary, cut off access to the above endpoints from the internet.
– Restrict access to trusted IPs/VPN.
– Implement perimeter rules (WAF/Reverse proxy/Firewall) to block specific paths.
2) Consider the need for the Environment Management Hub (PSEMHUB)
In many PeopleSoft environments, the PSEMHUB does not need to be publicly accessible. Where possible, disable/remove it or severely restrict it.
3) Hunt for signs of compromise – not just “we put mitigation in and we’re done”
The big risk in KEV/zero-day stories is that many organizations close the hole but don’t look back. Reports talk about techniques persistence/artefacts that can remain in the system.
See also: CISA: 3 days deadline to patch Ivanti critical vulnerability
Quick hunting checklist (practical, not theoretical)
– Web/Access logs: suspicious POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector, especially from unexpected IPs.
– Application files: unexpected .jsp or changes to PSEMHUB directories.
– Unusual outbound traffic: outbound SMB (TCP/445) monitoring from PeopleSoft servers to external destinations.
– Changes to configuration/metadata directories that are inconsistent with change windows.
4) Patch / vendor guidance
Where a patch or official Oracle guidance (security alert/mitigations) is available, apply them as an “emergency change”. If the environment is business-critical (HR/Finance/ERP), prefer controlled downtime to running with a potential active compromise.
See also: CISA: Cisco, Chrome and Arista vulnerabilities in the KEV List
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
What does it mean for Greece/businesses/admins/users?
– For Greek organizations (especially large companies, banks, public sector, universities) PeopleSoft remains a classic platform for HR/financial/administrative processes. A takeover is not just an “IT incident”: it can develop into a leak of personal employee/student data and into a business interruption.
– For MSPs/companies that provide ERP support: it is time for pro‑active exposure control and customer awareness (not only patching, but also assessment for potential breach).
