Summary
CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools that allows a remote attacker to take over an affected system through HTTP access without authentication. The vulnerability affects the Updates Environment Management component. Google GTIG and Mandiant linked the attacks to ShinyHunters, involving unauthorized access and data theft. Oracle issued an alert on June 10, 2026, and CISA added the flaw to its KEV Catalog on June 12.
Urgent Actions Required
- Apply Oracle's recommended fixes for affected PeopleSoft PeopleTools versions by following the official security alert.
- Restrict external access to the Environment Management Hub. Disable EMHub in multi-server setups or remove PSEMHUB in single-server setups.
- Check logs for suspicious requests to PeopleSoft endpoints.
- Check PSEMHUB.war for unexpected JSP files and unusual activity.
- If compromise is suspected, investigate unauthorized access and data theft.
Which Systems Are Vulnerable to CVE-2026-35273?
Technical Overview
- Vulnerability Type: Missing Authentication for a Critical Function (CWE-306)
- Affected Software/Versions:
- Oracle PeopleSoft Enterprise PeopleTools 8.61
- Oracle PeopleSoft Enterprise PeopleTools 8.62
- CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-35273 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-35273?
Vulnerability Root Cause:
CVE-2026-35273 is caused by missing authentication in the Updates Environment Management component of Oracle PeopleSoft PeopleTools. The flaw allows a remote attacker to access the affected functionality over HTTP without logging in, potentially taking control of the system. Attackers have also used URL-encoded paths to bypass WAF rules that check for literal application paths.
How Can You Mitigate CVE-2026-35273?
If immediate patching is delayed or not possible:
- Disable Environment Management Hub in multi-server configurations or remove the PSEMHUB application in single-server configurations, as applicable.
- Restrict external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector.
- Update WAF rules to block encoded paths.
- Check logs for suspicious requests and JSP files.
- Investigate unusual processes, remote access tools, and connections.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- PeopleSoft Applications: Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
- Environment Management Hub: The PSEMHUB application, which is involved in the reported exploitation
- Integration Interfaces: Review /PSIGW/HttpListeningConnector for exposure
- Business-Critical Systems at Risk:
- HR and Payroll: May store sensitive employee data
- Financial Systems: Financial information managed through affected PeopleSoft environments may be exposed
- Enterprise Applications: A compromised PeopleSoft system may be used as a starting point for movement into other systems
- Exposure Level:
- Internet-Accessible PeopleSoft Systems: Particularly relevant when affected interfaces are reachable by external attackers
- Internal Systems: Assess systems accessible through internal networks
- Cloud and DR Systems: Check affected versions, access, and remediation
How Can You Detect CVE-2026-35273 Exploitation?
Exploitation Signatures:
- POST requests to /PSEMHUB/hub or the encoded path /%50SEMHUB/hub
- Multiple requests to the encoded endpoint within a short period
- Unexpected JSP files, including x.jsp, u.jsp, and u2.jsp, in PSEMHUB.war
Indicators of Compromise (IOCs/IOAs):
- Unexpected JSP web shells, including x.jsp, u.jsp, u2.jsp, tunnel.jsp, and tunnel.jspx
- Unrecognized MeshCentral agents, including files disguised as Azure-related services
- Suspicious outbound connections associated with data staging, remote access, or exfiltration
Behavioral Indicators:
- Unexpected command shells spawned by the WebLogic Java process
- Unusual SSH activity indicating possible lateral movement
- Unexplained outbound data transfers or signs of data staging and extortion
Alerting Strategy:
- Priority: Critical
- Alert on repeated POST requests to /PSEMHUB/hub and /%50SEMHUB/hub
- Flag unexpected JSP files in PSEMHUB.war for investigation.
- Monitor unusual processes, remote access tools, SSH activity, and outbound connections that may indicate compromise.
Remediation & Response
- Remediation Timeline:
- Immediate: Apply Oracle's recommended mitigation for affected PeopleSoft PeopleTools versions 8.61 and 8.62
- As soon as possible: Disable Environment Management Hub in multi-server configurations or remove the PSEMHUB application in single-server configurations, as applicable
- After mitigation: Verify all relevant PeopleSoft nodes, including standby and disaster recovery systems, are covered
- Incident Response Considerations:
- Review PeopleSoft and WebLogic logs for suspicious requests to /PSEMHUB/hub, /%50SEMHUB/hub, and /PSIGW/HttpListeningConnector
- Examine PSEMHUB.war for unexpected JSP files and investigate suspicious processes or remote access tools
- Check for unusual SSH activity, outbound connections, data staging, and possible data exfiltration
- If compromise is suspected, preserve relevant evidence and initiate incident response
- Assess credential rotation needs and investigate whether attackers accessed other systems or sensitive data
Compliance & Governance Notes
- Audit Trail Requirement:
- Review PeopleSoft and WebLogic access logs for suspicious requests to /PSEMHUB/hub, /%50SEMHUB/hub, and /PSIGW/HttpListeningConnector.
- Document remediation actions and verify that all relevant PeopleSoft deployments, including standby and disaster recovery systems, are covered.
- Preserve relevant logs and endpoint evidence if exploitation is suspected.
- Record findings from investigations into suspicious JSP files, remote access tools, and unusual outbound connections.
- Policy Alignment:
- Follow Oracle's guidance for affected PeopleTools versions.
- Review access restrictions for the Environment Management Hub and related interfaces.
- Check encoded paths in security monitoring and WAF rules.
- Include PeopleSoft access, lateral movement, and data theft in incident response.
Strengthen Threat Detection and Response with Fidelis Elevate®
-
-
- Gain visibility across networks, endpoints, and cloud environments
- Correlate security activity to investigate potential post-breach attacks
- Bring network security, deception, and Active Directory protection together on one platform
- Support proactive cyber defense with Open and Active XDR
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.8 | Critical vulnerability with high potential impact across confidentiality, integrity, and availability |
| Attack Vector | Network | Exploitation is possible remotely over a network through HTTP access |
| Attack Complexity | Low | The CVSS assessment indicates that exploitation requires low complexity |
| Privileges Required | None | The attacker does not need to authenticate before exploiting the vulnerability |
| User Interaction | None | Exploitation does not require action from another user |
| Scope | Unchanged | The CVSS vector marks the scope as unchanged |
| Confidentiality Impact | High | Successful exploitation can severely affect the confidentiality of information |
| Integrity Impact | High | Successful exploitation can severely affect the integrity of information |
| Availability Impact | High | Successful exploitation can severely affect system availability |
References:
