Oracle PeopleSoft Security Update and Guidance

Oracle is aware of claims regarding the use of a PeopleSoft zero-day. Oracle has investigated and noted no evidence of a zero-day in use in the recently reported attacks.

Oracle recommends that customers remain on actively supported versions and apply all Critical Patch Updates, Critical Security Patch Updates, and Security Alerts without delay.

For CVE-2026-35273, customers should apply the applicable PeopleTools Critical Security Patch Update (CSPU) promptly. The vulnerability is addressed in cumulative updates for PeopleTools 8.61 and 8.62 beginning with the June 2026 CSPU, and for PeopleTools 8.63 beginning with the July 2026 CPU.

Web Application Firewall rules may provide additional defense in depth, but they are not a substitute for applying the applicable PeopleTools security update.