CriticalCISA KEVExploited in the wildPublic exploit

Unauthenticated RCE in Oracle PeopleSoft PeopleTools Environment Management Hub (PSEMHUB)

IdentifiersCVE-2026-35273CWE-306· Missing Authentication for…

CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, specifically the Updates Environment Management / Environment Management Hub (PSEMHUB or EMHub) component, affecting supported versions 8.61 and 8.62. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Multiple supporting sources characterize the issue as pre-authentication remote code execution in PSEMHUB/EMHub, with exploitation observed against HTTP-accessible endpoints including references to /PSIGW/HttpListeningConnector. The content consistently indicates that no authentication or user interaction is required and that successful exploitation can result in full takeover of the PeopleSoft platform.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to complete compromise of the affected PeopleSoft environment, with high impact to confidentiality, integrity, and availability. Reported outcomes include remote code execution, full platform takeover, access to sensitive ERP data such as HR, payroll, finance, billing, and student records, deployment of persistence tooling, lateral movement, and data exfiltration. CISA also notes known ransomware campaign use, indicating the flaw can be used for initial access leading to extortion or destructive follow-on activity.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or block external access to vulnerable PeopleSoft endpoints, especially the Environment Management Hub (EMHub/PSEMHUB). Supporting content specifically recommends disabling the EMHub service in multi-server PeopleSoft deployments or removing the PSEMHUB application in single-server deployments where feasible. Review WebLogic and web access logs for suspicious requests, inspect PSEMHUB application directories for unexpected JSP or other unauthorized files, and hunt for persistence or post-exploitation artifacts because active exploitation in the wild has been reported.

Remediation

Patch, then assume compromise.

Apply Oracle's June 2026 security fix / Critical Security Patch Update for Oracle PeopleSoft PeopleTools and Oracle PeopleSoft Enterprise Applications that addresses CVE-2026-35273. Oracle issued an out-of-band Security Alert on June 10, 2026 and subsequently included fixes in the June 2026 patch cycle. Because exploitation predated public disclosure, patching should be accompanied by incident response review to determine whether compromise occurred before remediation.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 3 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 3 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OraclePeoplesoftapplication

OraclePeoplesoft Enterprise Peopletoolsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

275 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

275 SOURCESView more in app

thecybersecguruNews

Jun 25, 2026

ShinyHunters MSG Breach: Facial Recognition Records Leaked | The CyberSec Guru

A critical unauthenticated remote code execution zero-day in Oracle PeopleSoft PeopleTools 8.61 and 8.62 affecting the Updates Environment Management / PSEMHUB component.

cyberthroneNews

Jun 19, 2026

The Vulnerabilities That Matter in Oracle’s June 2026 CSPU - TheCyberThrone

A critical unauthenticated remotely exploitable vulnerability in Oracle PeopleSoft PeopleTools Environment Management Hub (EMHub/PSEMHUB) that Oracle says can lead to remote code execution; it was exploited as a zero-day before a patch was released.

xakepNews

Jun 18, 2026

Группировка ShinyHunters заявила, что похитила данные у компании Kodak - Хакер

A critical zero-day vulnerability in Oracle PeopleSoft reportedly used by ShinyHunters in a global campaign affecting more than 100 organizations and hundreds of PeopleSoft instances.

cyber security newsNews

Jun 17, 2026

CISA Warns of Oracle PeopleSoft 0-Day Vulnerability Exploited in Ransomware Attacks

A critical authentication bypass vulnerability in Oracle PeopleSoft Enterprise PeopleTools that allows unauthenticated remote attackers to execute critical functions and potentially take full control of affected systems.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence24

Every observed campaign linking this CVE to a named adversary.

Associated malware11

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity177

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-35273

NVD

nvd.nist.gov/vuln/detail/CVE-2026-35273

MITRE CWE · CWE-306

Missing Authentication for Critical Function

Vendor Advisory

oracle.com/security-alerts/alert-cve-2026-35273.html

Third Party Advisory

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273