CVE-2026-35273

CVSS

—

EPSS

0.094 (95.2th percentile)

CISA KEV

Added 2026-06-12, due 2026-06-15

Exploitation

No report

Public exploits

3 repositories

State

Unknown

Coverage

• 

  ● Actively exploitedCritical 95The Hacker News◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record5 hours ago

  Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

  Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could…

  ↗thehackernews.com/2026/09/attackers-bypass-wafs…(opens the publisher's site in a new tab)

What we observed

1. 24 Sept, 12:30poc publishedpoc-in-github
2. 24 Sept, 12:15poc publishedpoc-in-github
3. 24 Sept, 11:52poc publishedpoc-in-github
4. 24 Sept, 11:50kev addedcisa-kev