Detect Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273) in Sumo Logic CSE
CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=web/iis OR _sourceCategory=web/apache OR _sourceCategory=proxy/bluecoat
| where %"cs-uri-stem" matches "/PSIGW/*" or %"cs-uri-stem" matches "/psp/*" or %"cs-uri-stem" matches "/psc/*" or %"cs-uri-stem" matches "/PeopleSoftServices/*"
| where isNull(%"cs-username") or %"cs-username" = "-" or %"cs-username" = "anonymous"
| where %"sc-status" in ("200", "201", "302")
| timeslice 5m
| stats
count as request_count,
dcount(%"cs-uri-stem") as unique_paths,
values(%"cs-uri-stem") as accessed_paths,
values(%"sc-status") as status_codes
by %"c-ip", _timeslice
| where request_count >= 2
| fields %"c-ip", request_count, unique_paths, accessed_paths, status_codes, _timeslice
| sort by request_count descSumo Logic query to detect unauthenticated HTTP access to Oracle PeopleSoft critical endpoints, correlating source IPs with access patterns consistent with CVE-2026-35273 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Service integrations using PSIGW with anonymous service contracts
- Scheduled report generation accessing PeopleSoft without interactive sessions
- Third-party vendor tools with legitimate anonymous access grants
- Internal network monitoring performing synthetic transaction checks
Other platforms for CVE-2026-35273
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated PSIGW Endpoint Probe
Expected signal: IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500
- Test 2PeopleSoft PSP Component Unauthenticated Access Attempt
Expected signal: Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302
- Test 3Simulated PeopleSoft Service Connector Enumeration
Expected signal: Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated
References (5)
- https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
- https://support.oracle.com/signin/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-35273
Response Playbook
Triage
- Identify all Oracle PeopleSoft PeopleTools instances in the environment and confirm version/patch level against Oracle Security Alert for CVE-2026-35273.
- Review IIS/web server access logs on PeopleSoft web tier hosts for requests to /PSIGW/, /psp/, and /psc/ paths from external or unexpected source IPs within the past 72 hours.
- Check PeopleSoft Application Server logs (PS_HOME/appserv/*/LOGS/) for unauthorized function invocations, particularly Component Interface or Integration Broker activity without corresponding authenticated sessions.
- Correlate source IPs from web logs against threat intelligence feeds to determine if observed IPs are associated with known threat actors or scanning infrastructure.
Containment
- Immediately apply network ACLs or WAF rules to block unauthenticated access to PeopleSoft PSIGW and critical integration endpoints from untrusted networks pending patch application.
- If active exploitation is confirmed, isolate the affected PeopleSoft web and application server tiers from the network and initiate incident response procedures while preserving forensic artifacts.
Evidence Collection
- Collect and preserve IIS/Apache access logs, PeopleSoft Application Server logs, and PeopleTools Integration Broker logs from the affected hosts, ensuring chain of custody.
- Capture memory dumps and running process lists from affected PeopleSoft web and application servers to identify any post-exploitation activity or persistence mechanisms.
Escalation Criteria
- !Escalate to Incident Response if source IPs are confirmed as external threat actors or if data exfiltration indicators (large outbound transfers, unusual DB query volumes) are observed on PeopleSoft DB tier.
- !Escalate to executive leadership and legal/compliance if PeopleSoft stores PII, financial records, or HR data and unauthorized access to those records is confirmed, triggering breach notification obligations.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PeopleSoft IIS/Apache access logs: %SystemDrive%\inetpub\logs\LogFiles\ (Windows) or /var/log/httpd/ (Linux) — review for PSIGW/psp/psc path access patterns - >
PeopleSoft Application Server logs: $PS_HOME/appserv/<domain>/LOGS/APPSRV_MMDD.LOG — review for unauthenticated Component Interface or service operation invocations - >
PeopleSoft Integration Broker logs: $PS_HOME/appserv/<domain>/LOGS/ — review for unauthorized inbound service requests via HttpListeningConnector - >
Windows Event Logs (Security, Application) on PeopleSoft web/app servers for process creation or service changes post-exploitation
Tuning Guidance
Tune detection thresholds (request_count >= 2-3) based on observed baseline traffic for your PeopleSoft integration endpoints. Whitelist known PeopleSoft integration service account IPs and authorized anonymous endpoint paths configured in Integration Broker. If PSIGW is internal-only, consider raising alert severity for any external source IP access. Reduce false positives by enriching with asset inventory — only alert on hosts confirmed as PeopleSoft servers.
Hunting Queries
Hunt for historically unauthenticated successful access to PeopleSoft endpoints over the past 7 days to identify prior exploitation or reconnaissance that may have preceded CVE-2026-35273 exploitation.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/PSIGW/", "/psp/", "/psc/")
| where csUsername == "-" or isempty(csUsername)
| where scStatus in ("200", "302")
| summarize count() by cIP, csUriStem, scStatus
| where count_ > 5
| order by count_ descindex=web sourcetype=iis earliest=-7d
| where match(cs_uri_stem, "(?i)/PSIGW/|/psp/|/psc/")
| where cs_username="-" OR isnull(cs_username)
| where sc_status IN ("200","302")
| stats count by c_ip, cs_uri_stem, sc_status
| where count > 5
| sort -countAtomic Red Team Tests
Simulate an unauthenticated probe of the PeopleSoft Integration Gateway HttpListeningConnector endpoint to test detection coverage for CVE-2026-35273.
Command
curl -v -k --max-time 10 'https://<PEOPLESOFT_HOST>/PSIGW/HttpListeningConnector' -H 'Content-Type: application/xml' --data '<?xml version="1.0"?><IBRequest/>'Cleanup
No cleanup required; read-only probe against lab PeopleSoft instance.Expected Telemetry
IIS/Apache access log entry: source IP, URI /PSIGW/HttpListeningConnector, no username (-), HTTP status 200 or 500
Expected Detection
SIEM alert triggered on unauthenticated access to /PSIGW/HttpListeningConnector with successful HTTP response
Attempt to access a PeopleSoft component portal URL without authentication to simulate CVE-2026-35273 exploitation path via the PSP web handler.
Command
curl -v -k --max-time 10 --cookie '' 'https://<PEOPLESOFT_HOST>/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.PT_PORTAL_ROOT.GBL' -H 'User-Agent: Mozilla/5.0 (compatible; CVE-2026-35273-test)'Cleanup
No cleanup required; no state written to server in unauthenticated probe.Expected Telemetry
Web server log entry showing /psp/ path access from test IP, username field empty or anonymous, HTTP 200 or 302
Expected Detection
Detection fires on unauthenticated access to /psp/ path with successful response code from non-whitelisted source IP
Enumerate PeopleSoft service connector endpoints without authentication to replicate attacker reconnaissance phase of CVE-2026-35273 exploitation.
Command
for path in '/PSIGW/HttpListeningConnector' '/PSIGW/PeopleSoftServiceListeningConnector' '/PSIGW/IBListeningConnector' '/psc/ps/' '/PeopleSoftServices/'; do echo "=== Testing $path ==="; curl -sk --max-time 5 -o /dev/null -w "%{http_code} %{url_effective}\n" "https://<PEOPLESOFT_HOST>${path}"; doneCleanup
No cleanup required; all requests are read-only HTTP probes.Expected Telemetry
Multiple IIS/Apache log entries from same source IP to different PeopleSoft paths within short time window, all unauthenticated
Expected Detection
SIEM detects burst of unauthenticated requests to PeopleSoft endpoints from single IP, triggering both the individual endpoint rule and any frequency-based aggregation rules