Oracle’s Critical Security Patch Update (CSPU) for June 2026, its second CSPU, addresses 243 CVEs, including 122 critical updates.

Oracle Critical Security Patch Update June 2026 | Tenable®

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Researchers confirm ShinyHunters (UNC6240) exploited this vulnerability as a zero-day primarily against the education sector. Apply the available patches as soon as possible.

This out of band update from Oracle resolves a RCE vulnerability. Immediate patching should be performed to protect from this threat

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (CVE-2026-35273)

The version of Oracle PeopleSoft PeopleTools installed on the remote host is 8.61.x prior to 8.61.20 or 8.62.x prior to 8.62.10. It is, therefore, affected by multiple vulnerabilities as noted in the June 2026 Critical Security Patch Update advisory, whose patches also resolve Oracle Security Alert CVE-2026-35273:

  - An unauthenticated server-side request forgery (SSRF) vulnerability in the Integration Broker that can be     relayed to the local Environment Management Hub (PSEMHUB) and chained to remote code execution. This issue     is known to be exploited in the wild. (CVE-2026-35273)

  - An unspecified vulnerability in the Performance Monitor component that is easily exploitable and allows an     unauthenticated attacker with network access via HTTP to compromise PeopleSoft PeopleTools. Successful     attacks can result in takeover of PeopleSoft PeopleTools. (CVE-2026-35278)

  - An unspecified vulnerability in the WebLogic component that allows an unauthenticated attacker with network     access via HTTP to compromise PeopleSoft PeopleTools, with unauthorized update, insert or delete access and     read access to a subset of accessible data. (CVE-2026-35271)

  - Multiple vulnerabilities in the Deployment Package, Application Server and Performance Monitor components     that can result in unauthorized access to or modification of data. (CVE-2026-35272, CVE-2026-35274,     CVE-2026-35276, CVE-2026-35279, CVE-2026-35288, CVE-2026-35289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle PeopleSoft PeopleTools server exposes both the Integration Broker gateway ('/PSIGW/HttpListeningConnector') and the Environment Management Hub ('/PSEMHUB/hub') on the same web tier. The Integration Broker fails to validate that XML documents submitted by unauthenticated clients do not reference internal or external network resources.

An attacker posts a crafted XML envelope (DOCTYPE external-entity, EnvironmentManagement message, or IBRequest SOAP message) whose 'sourceURL', 'url', or 'HubURL' element points to an attacker-controlled URL. The Integration Broker acts as an unauthenticated SSRF proxy:
  - Outbound: the IB resolves and fetches attacker-controlled external     URLs, leaking DNS queries and potentially cloud instance metadata.
  - Inbound loopback: when the SSRF target is http://127.0.0.1:<port>/     PSEMHUB/hub, the IB relays the request to the local Hub. The Hub     accepts loopback connections without authentication. Published exploit     chains pass a deserialized Java object in the 'OPERATION' POST     parameter to invoke Hub operations (FILECHUNKING,     REGISTER_WITHOUT_PEERNAME, HANDLE_MESSAGE) and achieve remote code     execution as the PeopleSoft application server user.

Nessus confirmed the SSRF non-destructively by:
  1. Verifying /PSEMHUB/hub is present (not mitigated by context root removal).
  2. Sending three XML payload shapes to /PSIGW/HttpListeningConnector      with the SSRF target set to a per-scan DNS callback URL.
  3. Detecting an outbound DNS resolution of the callback hostname,      which proves the Integration Broker followed the attacker-supplied URL.

A patched or mitigated system either returns HTTP 404 for /PSEMHUB/hub (context root removed) or rejects the XML before dereferencing the URL, and no DNS callback is observed.

Oracle PeopleSoft version 8.61 and 8.62 contain a vulnerability in the Updates Environment Management component that allows remote attackers to execute arbitrary code via a crafted HTTP request.

ID	Name	Product	Family	Type	Severity
331375	Oracle PeopleSoft PeopleTools Multiple Vulnerabilities (CSPU Jun 2026)	Nessus	Misc.	Local	critical
321385	Oracle PeopleSoft Unauthenticated Java Deserialization SSRF / RCE (CVE-2026-35273)	Nessus	Misc.	Remote	critical
115265	Oracle PeopleSoft 8.61 / 8.62 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical

Detections

Analytics

CVE-2026-35273

critical

Tenable Plugins

Coming Soon

critical

critical

critical