Detect Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273) in Elastic Security
CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where event.category == "network" and
url.path : ("/PSIGW/*", "/psp/*", "/psc/*", "/PeopleSoftServices/*") and
(user.name == null or user.name == "-" or user.name == "anonymous") and
http.response.status_code in (200, 201, 302)]
[network where event.category == "network" and
url.path : ("/PSIGW/*", "/psp/*", "/psc/*") and
http.response.status_code in (200, 201, 302)]EQL sequence query detecting repeated unauthenticated successful HTTP responses to Oracle PeopleSoft critical function endpoints, suggesting authentication bypass exploitation of CVE-2026-35273.
Data Sources
Required Tables
False Positives & Tuning
- PeopleSoft service mesh internal health check probes
- Authorized unauthenticated feed endpoints explicitly configured in PeopleTools
- Penetration testing activities against PeopleSoft environments
- Load balancer passive health checks to PeopleSoft web tier
Other platforms for CVE-2026-35273
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated PSIGW Endpoint Probe
Expected signal: IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500
- Test 2PeopleSoft PSP Component Unauthenticated Access Attempt
Expected signal: Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302
- Test 3Simulated PeopleSoft Service Connector Enumeration
Expected signal: Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated
References (5)
- https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
- https://support.oracle.com/signin/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-35273
Unlock Pro Content
Get the full detection package for CVE-2026-35273 including response playbook, investigation guide, and atomic red team tests.