Oracle is racing to contain multiple critical vulnerabilities across its enterprise software portfolio that allow remote attackers to execute arbitrary code, with at least one PeopleSoft flaw now under active exploitation by a known threat group.[2][4][8][15]
The most prominent issue is CVE-2026-35273, a deserialization vulnerability in Oracle PeopleSoft PeopleTools’ Environment Management Hub that can be exploited over the network to achieve remote code execution.[2][4] Oracle’s own advisory classifies the bug as remotely exploitable without authentication, while a separate technical analysis notes that existing authentication controls can be bypassed, allowing an attacker to run code in the context of the service account.[2][4] A related PeopleSoft PeopleTools issue, CVE-2026-35278, affects the Performance Monitor and EMHub components and has likewise been rated critical, with a CVSS score of 9.8.[6][8]
Security firm Waratek reports that both CVE-2026-35273 and CVE-2026-35278 have been actively exploited since late May 2026 in campaigns attributed to the ShinyHunters group, which chained the two bugs to gain deep access to vulnerable PeopleSoft environments.[8] In the same July 2026 patch cycle, Oracle also addressed unauthenticated remote code execution flaws in Fusion Middleware’s WebCenter Capture, tracked as CVE-2026-35280 and CVE-2026-35281, each carrying a CVSS score of 9.9 for their impact on confidentiality, integrity, and availability.[5][8] Independent coverage of the July Critical Patch Update notes that Fusion Middleware received several additional fixes rated at the maximum CVSS score of 10.0, underscoring the severity of the current batch of bugs.[7][15]
These vulnerabilities continue a broader trend of high-impact Oracle flaws that enable attackers to run arbitrary code with elevated privileges on servers and middleware platforms.[3][6][13][14] Previous advisories have detailed similar deserialization issues in Oracle Business Intelligence and ADF Faces that allowed unauthenticated attackers to execute code in the context of the service account or web server, demonstrating how a single weakness in input validation can translate into full application compromise.[13][14] Oracle’s April and June 2026 patch updates likewise included multiple remotely exploitable problems with CVSS scores between 9.1 and 9.9 across MySQL Enterprise Backup, Advanced Inbound Telephony, and other components, many of which were exploitable over the network without requiring user interaction.[5][6]
For organizations running PeopleSoft, Fusion Middleware, or other affected Oracle products, the practical impact is that a successful exploit can grant an attacker the same privileges as the service account or logged-on user, enabling them to install programs, modify or delete data, or create new accounts with broad access.[4][13][14] Environments that follow least-privilege principles for application and database accounts are likely to experience reduced blast radius, while deployments that run services with administrative rights face the greatest risk of complete system takeover. ShinyHunters’ use of chained PeopleSoft vulnerabilities to drive real-world intrusions highlights how quickly attackers move to weaponize newly disclosed flaws.[8]
Defenders are advised to prioritize deployment of Oracle’s July 2026 Critical Patch Update and any out-of-band security alerts related to CVE-2026-35273 and associated issues, with particular focus on internet-facing PeopleSoft and Fusion Middleware instances.[2][5][8][15] Security teams should also review logs for signs of suspicious activity in PeopleTools and WebCenter Capture components, implement tight network segmentation around Oracle application servers, and harden authentication and access controls so that even if code execution is achieved, the attacker’s effective privileges are constrained. Users and services configured with minimal required rights will be less impacted than those operating with broad administrative permissions, making least privilege a critical complement to timely patching.
References
- Oracle Security Alert Advisory – CVE-2026-35273
- 2 Other Critical (cvss 9+)…
- ZDI-26-388
- Text Form of Oracle CSPU June 2026 Risk Matrices
- Oracle Critical Patch Update, April 2026 Security Update Review
- Text Form of Oracle CPU July 2026 Risk Matrices
- Oracle Releases the July 2026 Critical Patch Update – Waratek
- ZDI-20-505 | Zero Day Initiative
- ZDI-19-1024 – Zero Day Initiative
- Oracle issues critical patches for Database Server, Fusion Middleware
