Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-35273.
Unlock with Pro - from £29/user/moDetect Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273) in CrowdStrike LogScale
CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| TargetFileName=/(?i)(psigw|psp|psc|PeopleSoftServices)/
OR HttpUri=/(?i)\/PSIGW\/(HttpListeningConnector|PeopleSoftServiceListeningConnector)/
| eval auth_missing = if(isnull(UserName) OR UserName IN ("-", "anonymous", ""), 1, 0)
| where auth_missing = 1
| where HttpStatusCode IN ("200", "201", "302")
| stats
count() as request_count,
dc(HttpUri) as distinct_uris,
values(HttpUri) as uris_accessed,
min(timestamp) as first_seen,
max(timestamp as last_seen
by RemoteAddressIP4, ComputerName
| where request_count >= 2
| eval alert = "CVE-2026-35273: PeopleSoft unauthenticated critical function access"CrowdStrike Falcon LogScale CQL query to detect network connections and HTTP requests to Oracle PeopleSoft PSIGW endpoints without authentication, identifying potential CVE-2026-35273 exploitation on monitored endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Falcon-protected servers running PeopleSoft with configured anonymous service endpoints
- Internal automation accessing PeopleSoft APIs with system context not logged
- Integration broker middleware relaying requests without preserving original user identity
- Vulnerability scanners in authorized scan windows touching PeopleSoft paths
Other platforms for CVE-2026-35273
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated PSIGW Endpoint Probe
Expected signal: IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500
- Test 2PeopleSoft PSP Component Unauthenticated Access Attempt
Expected signal: Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302
- Test 3Simulated PeopleSoft Service Connector Enumeration
Expected signal: Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated
References (5)
- https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
- https://support.oracle.com/signin/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-35273
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-35273 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month