Latest Oracle PeopleSoft vulnerability: CVE-2026-35273 #
Oracle disclosed that certain versions of the PeopleSoft Enterprise PeopleTools solution utilize the Environment Management Hub (EMHub) service that contains a server-side request forgery (SSRF) vulnerability. Remote unauthenticated attackers can utilize this vulnerability to chain outbound requests to achieve remote code execution and gain access to the underlying operating system.
Note: There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected:
- Oracle PeopleSoft: Versions 8.61 and 8.62.
What is Oracle PeopleSoft? #
PeopleSoft is an enterprise resource planning (ERP) platform used for managing large organizations' business functions.
What is the impact? #
Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Oracle PeopleSoft: Versions 8.61 and 8.62 should apply the supplied vendor patch immediately.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially impacted assets:
_asset.protocol:http AND protocol:http AND (http.head.setCookie:"PS_TOKEN=" OR last.html.title:="Oracle PeopleSoft Sign-in" OR html.title:="Oracle PeopleSoft Sign-in")
