We've released a Rapid Response test for CVE-2026-35273, a critical unauthenticated remote code execution vulnerability affecting Oracle PeopleSoft PeopleTools.

The vulnerability impacts PeopleTools 8.61 and 8.62 and requires only network access to a reachable PeopleSoft endpoint to achieve remote code execution. No authentication or user interaction is required.

What makes this especially important is that exploitation was observed before Oracle publicly disclosed the issue. According to Mandiant and Google Threat Intelligence Group, activity attributed to UNC6240 (ShinyHunters) targeted PeopleSoft infrastructure between late May and early June 2026.

PeopleSoft environments often support critical business functions such as:

* Human resources
* Payroll
* Finance
* Student information systems

As a result, successful compromise can expose large volumes of employee, student, financial, and operational data.

Recommended actions:
* Apply Oracle's mitigations immediately
* Ensure Environment Management Hub (PSEMHUB) endpoints are not reachable from the internet
* Upgrade unsupported PeopleTools deployments
* Prioritize externally accessible PeopleSoft environments

We've released a Rapid Response test to help organizations determine whether this vulnerability is actually exploitable in their environment and to validate remediation after mitigation efforts: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-35273/

CVE-2026-35273: Oracle PeopleSoft PeopleTools Unauthenticated Remote Code Execution Vulnerability