CISA 2026-06-12

CISA Adds One Known Exploited Vulnerability to Catalog

CVE-2026-35273

Machine-generated analysis · WAYSCloud LLM

The added vulnerability affects Oracle PeopleSoft Enterprise PeopleTools and involves missing authentication for a critical function.

Context

Oracle PeopleSoft Enterprise PeopleTools is a suite used to build and run enterprise applications. The advisory states that CVE-2026-35273 allows exploitation due to missing authentication for a critical function. This vulnerability is now included in CISA's Known Exploited Vulnerabilities catalog based on evidence of active exploitation. BOD 26-04 mandates federal agencies to prioritize remediation of such vulnerabilities on publicly exposed assets.

Operator considerations

Check: Oracle PeopleSoft Enterprise PeopleTools instances exposed to the internet.
Patch: Apply available updates if the vendor has released a fix for CVE-2026-35273.
Log: Monitor access logs for unauthorized activity on affected PeopleTools endpoints.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, updating BOD 22-01. BOD 26-04 reinforces the importance of the KEV catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog on publicl...

Read the full advisory on CISA →