Oracle’s Critical Security Patch Update (CSPU) for June 2026, its second CSPU, addresses 243 CVEs, including 122 critical updates.

Oracle Critical Security Patch Update June 2026 | Tenable®

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Researchers confirm ShinyHunters (UNC6240) exploited this vulnerability as a zero-day primarily against the education sector. Apply the available patches as soon as possible.

This out of band update from Oracle resolves a RCE vulnerability. Immediate patching should be performed to protect from this threat

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (CVE-2026-35273)

The remote Oracle PeopleSoft PeopleTools server exposes both the Integration Broker gateway ('/PSIGW/HttpListeningConnector') and the Environment Management Hub ('/PSEMHUB/hub') on the same web tier. The Integration Broker fails to validate that XML documents submitted by unauthenticated clients do not reference internal or external network resources.

An attacker posts a crafted XML envelope (DOCTYPE external-entity, EnvironmentManagement message, or IBRequest SOAP message) whose 'sourceURL', 'url', or 'HubURL' element points to an attacker-controlled URL. The Integration Broker acts as an unauthenticated SSRF proxy:
  - Outbound: the IB resolves and fetches attacker-controlled external     URLs, leaking DNS queries and potentially cloud instance metadata.
  - Inbound loopback: when the SSRF target is http://127.0.0.1:<port>/     PSEMHUB/hub, the IB relays the request to the local Hub. The Hub     accepts loopback connections without authentication. Published exploit     chains pass a deserialized Java object in the 'OPERATION' POST     parameter to invoke Hub operations (FILECHUNKING,     REGISTER_WITHOUT_PEERNAME, HANDLE_MESSAGE) and achieve remote code     execution as the PeopleSoft application server user.

Nessus confirmed the SSRF non-destructively by:
  1. Verifying /PSEMHUB/hub is present (not mitigated by context root removal).
  2. Sending three XML payload shapes to /PSIGW/HttpListeningConnector      with the SSRF target set to a per-scan DNS callback URL.
  3. Detecting an outbound DNS resolution of the callback hostname,      which proves the Integration Broker followed the attacker-supplied URL.

A patched or mitigated system either returns HTTP 404 for /PSEMHUB/hub (context root removed) or rejects the XML before dereferencing the URL, and no DNS callback is observed.

Oracle PeopleSoft version 8.61 and 8.62 contain a vulnerability in the Updates Environment Management component that allows remote attackers to execute arbitrary code via a crafted HTTP request.

ID	Name	Product	Family	Severity
321385	Oracle PeopleSoft Unauthenticated Java Deserialization SSRF / RCE (CVE-2026-35273)	Nessus	Misc.	critical
115265	Oracle PeopleSoft 8.61 / 8.62 Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2026-35273

critical

Tenable Plugins

Coming Soon

critical

critical