CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication Allows Unauthenticated Takeover
What It Is – PeopleSoft Enterprise PeopleTools contains a missing authentication check on a privileged function. An attacker who can reach the vulnerable endpoint can execute the function without any valid credentials, potentially gaining full control of the PeopleTools environment.
Exploitability – No public exploit has been observed, but the vulnerability is rated High severity (CVSS ≈ 9.0) because successful exploitation leads to complete system takeover.
Affected Products – Oracle PeopleSoft Enterprise PeopleTools (all supported versions at time of advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for access‑control assurance: only authorized identities should be able to invoke privileged functions.
- Continuous monitoring of authentication events provides defensible evidence that the control is operating as intended.
- Auditors increasingly request proof that critical ERP modules are protected by strong identity‑centric controls; a missing check undermines that trust.
Recommended Actions
- Apply Oracle’s security patch for CVE‑2026‑35273 as soon as it is released.
- Conduct a rapid review of all PeopleTools customizations and configuration to verify that every privileged function enforces authentication and, where appropriate, multi‑factor authentication.
- Enable detailed logging of access to PeopleTools administrative APIs and ingest those logs into a SIEM for continuous monitoring.
- Map the missing‑authentication issue to the “ensure only authorized users can execute privileged functions” control objective in your chosen framework (e.g., NIST CSF 2.0 PR‑PR‑01) and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑35273