Oracle PeopleSoft Zero‑Day CVE‑2026‑35273 Re‑Exploited

Oracle Corporation’s PeopleSoft product line has once again fallen victim to a critical vulnerability identified as CVE‑2026‑35273. The flaw targets older versions of the Java web services that handle user authentication tokens without proper validation, allowing attackers to bypass security controls and potentially gain unauthorized access to sensitive data. Reports indicate the exploit remains active even though it was already covered earlier under “All Sectors” coverage, suggesting continued exploitation against unpatched or outdated installations. ¹

The technical details reveal that CVE‑2026‑35273 involves improper handling of authentication tokens within PeopleSoft’s web services layer, allowing attackers to impersonate legitimate users or elevate privileges. Similar to the Apache Struts vulnerability CVE-2017-5638, this mismanagement led to widespread breaches across multiple industries. ¹

Organizations using older PeopleSoft releases often delay upgrades due to extensive testing required for custom integrations. Many enterprises still rely on manual upgrade cycles that extend over weeks or months, making legacy systems attractive targets for threat actors who scan for known zero-days like CVE‑2026‑35273. ¹

Security teams are advised to apply available patches and conduct penetration tests focused on authentication flows. Reviewing continuous integration workflows helps ensure rapid deployment of updates once new advisories surface. ¹

Overall, the re‑exploitation of CVE‑2026‑35273 underscores the persistent risk posed by unpatched legacy software. It serves as a reminder that vulnerabilities discovered years earlier can resurface with renewed vigor, especially when organizations lag behind patch cycles due to compatibility concerns or resource constraints. Maintaining robust vulnerability management programs and adopting automated update pipelines remain essential defenses against such evolving threats. ¹