ZDI 2026-06-24

ZDI-26-387: Oracle PeopleSoft HttpListeningConnector Server-Side Request Forgery Vulnerability

CVE-2026-35273

Machine-generated analysis · WAYSCloud LLM

The vulnerability in Oracle PeopleSoft's HttpListeningConnector permits unauthenticated remote attackers to trigger arbitrary server-side requests.

Context

The affected component is Oracle PeopleSoft's HttpListeningConnector. The vulnerability is a server-side request forgery (SSRF) issue that does not require authentication for exploitation. The advisory notes a CVSS score of 9.3, indicating high severity according to the scoring system. Worth noting is that the SSRF condition could potentially allow access to internal systems if the underlying infrastructure permits it, based on the nature of such vulnerabilities.

Operator considerations

Check: Identify deployments of Oracle PeopleSoft utilizing the HttpListeningConnector component.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Oracle PeopleSoft. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.3. The following CVEs are assigned: CVE-2026-35273.

Read the full advisory on ZDI →