Identifier timeline
CVE-2026-35273
Sessions
- 2026-07-04
CVE-2026-35273
- 2026-07-02
CVE-2026-35273
- 2026-07-02
CVE-2026-35273
- 2026-07-01
Oracle risk split into two lanes: PeopleSoft CVE-2026-35273 was treated as a real employee-data theft/extortion campaig
- Community roundtable
Oracle PeopleSoft CVE-2026-35273 rose to board-level urgency where exposed, especially for H
- 2026-06-30
Oracle PeopleSoft CVE-2026-35273 required emergency review and compromise hunting for expose
- 2026-06-30
CVE-2026-35273
- 2026-06-29
CVE-2026-35273
- 2026-06-22
med PeopleSoft exploitation campaign is under way involving CVE-2026-35273 and UNC6240/ShinyHunters activity, but the Council of Europ
- 2026-06-20
PeopleSoft CVE-2026-35273 is a real unauthenticated HTTP issue in PeopleTools 8.61/8.
Decision Records
Prioritize exposed enterprise systems over bulk patching
Prioritize exposed SharePoint Server, SonicWall SMA1000, and vulnerable Joomla deployments for patching or isolation within 24 hours; preserve logs and hunt for web shells, authentication-bypass activity, appliance abuse, and post-exploitation before declaring systems clean. Stage the broader Microsoft patch wave by exposure and business criticality.
Defenders should prioritize internet-exposed SharePoint Server, SonicWall SMA1000, and Joomla deployments flagged in the packet for rapid remediation or isolation, preserve relevant logs, and perform compromise checks before treating remediation as complete. Broader patch waves should be staged by exposure and business criticality.
Treat exposed AI workflow environments as credential-exposure risk
Inventory Langflow, Marimo, AI IDE, notebook, and browser-agent deployments. For exposed or secrets-connected systems, remove public exposure, patch or isolate Marimo-style deployments until verified fixed, rotate touched cloud/API credentials, restrict secret-store and authenticated-app access, and log agent/tool activity.
Inventory AI workflow, notebook, IDE, and browser-agent deployments, prioritizing systems exposed to untrusted networks or connected to production secrets. Remove public exposure, isolate where a verified fix is not available, rotate touched credentials, restrict secret-store access, and log agent/tool activity.