CVE-2026-35273 CrowdStrike LogScale · LogScale

Detect Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273) in CrowdStrike LogScale

CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| TargetFileName=/(?i)(psigw|psp|psc|PeopleSoftServices)/
  OR HttpUri=/(?i)\/PSIGW\/(HttpListeningConnector|PeopleSoftServiceListeningConnector)/
| eval auth_missing = if(isnull(UserName) OR UserName IN ("-", "anonymous", ""), 1, 0)
| where auth_missing = 1
| where HttpStatusCode IN ("200", "201", "302")
| stats
    count() as request_count,
    dc(HttpUri) as distinct_uris,
    values(HttpUri) as uris_accessed,
    min(timestamp) as first_seen,
    max(timestamp as last_seen
  by RemoteAddressIP4, ComputerName
| where request_count >= 2
| eval alert = "CVE-2026-35273: PeopleSoft unauthenticated critical function access"
critical severity medium confidence

CrowdStrike Falcon LogScale CQL query to detect network connections and HTTP requests to Oracle PeopleSoft PSIGW endpoints without authentication, identifying potential CVE-2026-35273 exploitation on monitored endpoints.

Data Sources

CrowdStrike FalconFalcon LogScaleFalcon Network Containment

Required Tables

NetworkConnectIP4HttpRequest

False Positives & Tuning

  • Falcon-protected servers running PeopleSoft with configured anonymous service endpoints
  • Internal automation accessing PeopleSoft APIs with system context not logged
  • Integration broker middleware relaying requests without preserving original user identity
  • Vulnerability scanners in authorized scan windows touching PeopleSoft paths

Other platforms for CVE-2026-35273

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated PSIGW Endpoint Probe

    Expected signal: IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500

  2. Test 2PeopleSoft PSP Component Unauthenticated Access Attempt

    Expected signal: Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302

  3. Test 3Simulated PeopleSoft Service Connector Enumeration

    Expected signal: Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated

Last updated: 2026-06-19 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all Oracle PeopleSoft PeopleTools instances in the environment and confirm version/patch level against Oracle Security Alert for CVE-2026-35273.
  2. Review IIS/web server access logs on PeopleSoft web tier hosts for requests to /PSIGW/, /psp/, and /psc/ paths from external or unexpected source IPs within the past 72 hours.
  3. Check PeopleSoft Application Server logs (PS_HOME/appserv/*/LOGS/) for unauthorized function invocations, particularly Component Interface or Integration Broker activity without corresponding authenticated sessions.
  4. Correlate source IPs from web logs against threat intelligence feeds to determine if observed IPs are associated with known threat actors or scanning infrastructure.

Containment

  1. Immediately apply network ACLs or WAF rules to block unauthenticated access to PeopleSoft PSIGW and critical integration endpoints from untrusted networks pending patch application.
  2. If active exploitation is confirmed, isolate the affected PeopleSoft web and application server tiers from the network and initiate incident response procedures while preserving forensic artifacts.

Evidence Collection

  1. Collect and preserve IIS/Apache access logs, PeopleSoft Application Server logs, and PeopleTools Integration Broker logs from the affected hosts, ensuring chain of custody.
  2. Capture memory dumps and running process lists from affected PeopleSoft web and application servers to identify any post-exploitation activity or persistence mechanisms.

Escalation Criteria

  • !Escalate to Incident Response if source IPs are confirmed as external threat actors or if data exfiltration indicators (large outbound transfers, unusual DB query volumes) are observed on PeopleSoft DB tier.
  • !Escalate to executive leadership and legal/compliance if PeopleSoft stores PII, financial records, or HR data and unauthorized access to those records is confirmed, triggering breach notification obligations.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >PeopleSoft IIS/Apache access logs: %SystemDrive%\inetpub\logs\LogFiles\ (Windows) or /var/log/httpd/ (Linux) — review for PSIGW/psp/psc path access patterns
  • >PeopleSoft Application Server logs: $PS_HOME/appserv/<domain>/LOGS/APPSRV_MMDD.LOG — review for unauthenticated Component Interface or service operation invocations
  • >PeopleSoft Integration Broker logs: $PS_HOME/appserv/<domain>/LOGS/ — review for unauthorized inbound service requests via HttpListeningConnector
  • >Windows Event Logs (Security, Application) on PeopleSoft web/app servers for process creation or service changes post-exploitation

Tuning Guidance

Tune detection thresholds (request_count >= 2-3) based on observed baseline traffic for your PeopleSoft integration endpoints. Whitelist known PeopleSoft integration service account IPs and authorized anonymous endpoint paths configured in Integration Broker. If PSIGW is internal-only, consider raising alert severity for any external source IP access. Reduce false positives by enriching with asset inventory — only alert on hosts confirmed as PeopleSoft servers.

Hunting Queries

Hunt for historically unauthenticated successful access to PeopleSoft endpoints over the past 7 days to identify prior exploitation or reconnaissance that may have preceded CVE-2026-35273 exploitation.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/PSIGW/", "/psp/", "/psc/")
| where csUsername == "-" or isempty(csUsername)
| where scStatus in ("200", "302")
| summarize count() by cIP, csUriStem, scStatus
| where count_ > 5
| order by count_ desc
Hunting — SPL
spl 
index=web sourcetype=iis earliest=-7d
| where match(cs_uri_stem, "(?i)/PSIGW/|/psp/|/psc/")
| where cs_username="-" OR isnull(cs_username)
| where sc_status IN ("200","302")
| stats count by c_ip, cs_uri_stem, sc_status
| where count > 5
| sort -count

Atomic Red Team Tests

Test 1 Unauthenticated PSIGW Endpoint Probe
linux

Simulate an unauthenticated probe of the PeopleSoft Integration Gateway HttpListeningConnector endpoint to test detection coverage for CVE-2026-35273.

Command

bash 
curl -v -k --max-time 10 'https://<PEOPLESOFT_HOST>/PSIGW/HttpListeningConnector' -H 'Content-Type: application/xml' --data '<?xml version="1.0"?><IBRequest/>'

Cleanup

bash 
No cleanup required; read-only probe against lab PeopleSoft instance.

Expected Telemetry

IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500

Expected Detection

SIEM alert triggered on unauthenticated access to /PSIGW/HttpListeningConnector with successful HTTP response

Test 2 PeopleSoft PSP Component Unauthenticated Access Attempt
linux

Attempt to access a PeopleSoft component portal URL without authentication to simulate CVE-2026-35273 exploitation path via the PSP web handler.

Command

bash 
curl -v -k --max-time 10 --cookie '' 'https://<PEOPLESOFT_HOST>/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.PT_PORTAL_ROOT.GBL' -H 'User-Agent: Mozilla/5.0 (compatible; CVE-2026-35273-test)'

Cleanup

bash 
No cleanup required; no state written to server in unauthenticated probe.

Expected Telemetry

Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302

Expected Detection

Detection fires on unauthenticated access to /psp/ path with successful response code from non-whitelisted source IP

Test 3 Simulated PeopleSoft Service Connector Enumeration
linux

Enumerate PeopleSoft service connector endpoints without authentication to replicate attacker reconnaissance phase of CVE-2026-35273 exploitation.

Command

bash 
for path in '/PSIGW/HttpListeningConnector' '/PSIGW/PeopleSoftServiceListeningConnector' '/PSIGW/IBListeningConnector' '/psc/ps/' '/PeopleSoftServices/'; do echo "=== Testing $path ==="; curl -sk --max-time 5 -o /dev/null -w "%{http_code} %{url_effective}\n" "https://<PEOPLESOFT_HOST>${path}"; done

Cleanup

bash 
No cleanup required; all requests are read-only HTTP probes.

Expected Telemetry

Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated

Expected Detection

SIEM detects burst of unauthenticated requests to PeopleSoft endpoints from single IP, triggering both the individual endpoint rule and any frequency-based aggregation rules

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1556Modify Authentication Process

Same Tactic: Initial Access

Popular Detections