CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) affecting the Updates Environment Management component. The flaw allows unauthenticated remote attackers to execute code via HTTP, resulting in complete takeover of the PeopleSoft environment. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has published a security alert advising immediate application of mitigations and patches for supported versions. The vulnerability is remotely exploitable without user interaction or privileges. Oracle recommends customers stay on supported versions and apply all relevant security updates without delay.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected PeopleSoft Enterprise PeopleTools environment. This leads to full compromise of confidentiality, integrity, and availability of the system. The attacker can take complete control of the environment, potentially disrupting business operations and exposing sensitive data.

Oracle has released a security alert recommending immediate application of available patches and mitigations for supported versions 8.61 and 8.62. Customers should apply all Critical Patch Updates, Critical Security Patch Updates, and Security Alerts without delay. Oracle advises remaining on actively-supported versions to ensure availability of patches. Since the product is not a cloud service, remediation depends on customer action. Patch status is not explicitly stated in the advisory; therefore, customers should consult the Oracle security alert and patch availability documentation for current remediation guidance.