Oracle PeopleTools CVE-2026-35273 Exploitation — Critical Detection and Remediation Guide

---
title: Potential CVE-2026-35273 Exploitation - PeopleTools Suspicious Request Pattern
id: 8a7b9c4d-3e5f-4a2b-8d1e-5f6a7b8c9d0e
status: experimental
description: Detects potential exploitation of CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools based on suspicious HTTP request patterns to known vulnerable endpoints.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.35273
logsource:
  category: web_access
  product: webserver
detection:
  selection:
    c-uri|contains:
      - '/psc/ps/'
      - '/EMPLOYEE/PSFT_HR/'
      - '/PORTAL.HTML'
    cs-method: POST
    cs-uri-query|contains:
      - 'ICType='
      - 'ICElementNumber='
      - 'PortalRegistryName='
  filter_main:
    sc-status:
      - 200
      - 500
  timeframe: 5m
condition: selection and filter_main | count() > 20
falsepositives:
  - High-volume legitimate PeopleTools usage during batch processing
level: high
---
title: PeopleTools Process Spawning Suspicious Child Process
id: 1d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects potential code execution through CVE-2026-35273 by monitoring for suspicious child processes spawned by PeopleTools-related parent processes.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.35273
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\psappsrv.exe'
      - '\psprcsrv.exe'
      - '\pssrchsrv.exe'
      - '\PSNTSVR.EXE'
  filter_legit:
    Image|contains:
      - '\psappsrv.exe'
      - '\psprcsrv.exe'
      - '\psadmin.exe'
      - '\java.exe'
  filter_tech:
    Image|contains:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection and filter_legit and filter_tech
falsepositives:
  - Legitimate administrative maintenance activities
  - Custom integration scripts
level: critical
---
title: Unusual PeopleTools Database Access Patterns
id: 7f8e9d0c-1b2a-3c4d-5e6f-7a8b9c0d1e2f
status: experimental
description: Detects potential data exfiltration following CVE-2026-35273 exploitation by monitoring for unusual database access patterns from PeopleTools application servers.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.exfiltration
  - attack.t1078
  - cve.2026.35273
logsource:
  category: database
  product: oracle
detection:
  selection:
    program_name|contains:
      - 'PSAPPSRV'
      - 'PSPRCSRV'
  selection_time:
    query_time|re: '(02|03|04|05):[0-5][0-9]:[0-5][0-9]'
  selection_operation:
    sql_operation:
      - 'SELECT'
      - 'EXPORT'
  selection_tables:
    sql_text|contains:
      - 'PSOPRDEFN'
      - 'PSPERSONAL_DATA'
      - 'PSPNLNAME'
      - 'PSROLEUSER'
  condition: selection and selection_time and selection_operation and selection_tables
falsepositives:
  - Scheduled report generation during off-hours
  - Legitimate data export operations
level: high

// Hunt for potential CVE-2026-35273 exploitation in PeopleTools
// Monitor for suspicious web access patterns to PeopleTools endpoints
let PeopleToolsEndpoints = dynamic(["/psc/ps/", "/EMPLOYEE/PSFT_HR/", "/PORTAL.HTML", "/s/WEBLIB_PTBR.ISCRIPT1.FieldFormula.IScript_GetImage"]);
let TimeFrame = 1d;
let HighVolumeThreshold = 50;

CommonSecurityLog
| where TimeGenerated >= ago(TimeFrame)
| where RequestURL has_any(PeopleToolsEndpoints)
| where RequestMethod == "POST"
| where DeviceVendor contains "Oracle" or DeviceProduct contains "PeopleSoft"
| extend suspicious_indicators = pack_all()
| summarize count(), make_set(RequestURL), make_set(SourceIP), make_set(DestinationIP), min(TimeGenerated), max(TimeGenerated) by DeviceProduct, SuspiciousActivity = iff(count_ > HighVolumeThreshold, "High Volume Potential Exploitation", "Normal")
| where SuspiciousActivity == "High Volume Potential Exploitation"
| order by count_ desc
| extend Recommendation = "Isolate affected PeopleTools server, review access logs for successful exploitation, apply Oracle patches for CVE-2026-35273 immediately"

// Monitor for suspicious process execution from PeopleTools services
DeviceProcessEvents
| where TimeGenerated >= ago(TimeFrame)
| where InitiatingProcessFileName in~ ("psappsrv.exe", "psprcsrv.exe", "pssrchsrv.exe", "PSNTSVR.EXE")
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "reg.exe", "whoami.exe", "net.exe", "net1.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessFileName, ProcessCommandLine
| extend Recommendation = "Potential code execution via CVE-2026-35273. Capture memory image of affected process, terminate if suspicious, initiate incident response"

-- Hunt for potential CVE-2026-35273 exploitation indicators on Windows endpoints
-- This artifact checks for suspicious process execution from PeopleTools services

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ '(psappsrv|psprcsrv|pssrchsrv|PSNTSVR)\.exe'
  AND Pid IN (
    SELECT ParentPid
    FROM pslist()
    WHERE Name =~ '(cmd|powershell|pwsh|wscript|cscript|reg|whoami|net|net1)\.exe'
  )

-- Check for suspicious modifications to PeopleTools directories
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/*PeopleTools*/" + "**/*")
WHERE Mtime > now() - timedelta(hours=24)
  AND NOT FullPath =~ '(\.log|\.tmp|\.cache)'

-- Review network connections from PeopleTools processes
SELECT Pid, Family, RemoteAddr, RemotePort, State, Uid, StartTime
FROM netstat()
WHERE Pid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ '(psappsrv|psprcsrv|pssrchsrv|PSNTSVR)\.exe'
  )
  AND State =~ '(ESTABLISHED|CLOSE_WAIT)'
  AND RemotePort NOT IN (80, 443, 1521, 1522, 1526)

# Script to verify Oracle PeopleTools patch status for CVE-2026-35273
# Run with appropriate administrative privileges

# Define registry key path for PeopleSoft installations
$regPath = "HKLM:\SOFTWARE\Oracle\PeopleTools"

# Function to check PeopleTools version
function Get-PeopleToolsVersion {
    $versions = @()
    if (Test-Path $regPath) {
        Get-ChildItem $regPath | ForEach-Object {
            $installPath = (Get-ItemProperty $_.PSPath).InstallPath
            if ($installPath -and (Test-Path "$installPath\bin\psappsrv.exe")) {
                $fileInfo = Get-Item "$installPath\bin\psappsrv.exe"
                $versions += [PSCustomObject]@{
                    InstallationPath = $installPath
                    Version = $fileInfo.VersionInfo.FileVersion
                    LastModified = $fileInfo.LastWriteTime
                    IsVulnerable = $fileInfo.VersionInfo.FileVersion -lt "8.60.10"  # Update with actual patched version
                }
            }
        }
    }
    return $versions
}

# Function to check for signs of potential exploitation
function Test-PeopleToolsExploitationIndicators {
    $indicators = @()
    
    # Check for suspicious process execution
    $suspiciousProcesses = Get-WmiObject Win32_Process |
        Where-Object { $_.Name -match "(psappsrv|psprcsrv|pssrchsrv)\.exe" } |
        ForEach-Object { 
            $children = Get-WmiObject Win32_Process -Filter "ParentProcessId=$($_.ProcessId)"
            if ($children.Name -match "(cmd|powershell|pwsh|wscript|cscript)\.exe") {
                $indicators += [PSCustomObject]@{
                    IndicatorType = "Suspicious Child Process"
                    Details = "$($_.Name) (PID: $($_.ProcessId)) spawned $($children.Name) (PID: $($children.ProcessId))"
                }
            }
        }
    
    # Check for recent file modifications in PeopleTools directories
    $peopleToolsDirs = Get-ChildItem -Path "C:\*PeopleTools*" -Directory -ErrorAction SilentlyContinue
    foreach ($dir in $peopleToolsDirs) {
        $recentFiles = Get-ChildItem -Path $dir.FullName -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(24) -and $_.Extension -notin ".log", ".tmp" }
        
        if ($recentFiles.Count -gt 0) {
            $indicators += [PSCustomObject]@{
                IndicatorType = "Recent File Modifications"
                Details = "$($recentFiles.Count) files modified in $($dir.FullName) in the last 24 hours"
            }
        }
    }
    
    return $indicators
}

# Main execution
Write-Host "Checking Oracle PeopleSoft Enterprise PeopleTools for CVE-2026-35273..." -ForegroundColor Yellow

$versions = Get-PeopleToolsVersion
if ($versions.Count -eq 0) {
    Write-Host "No PeopleTools installations found on this system." -ForegroundColor Green
} else {
    Write-Host "Found $($versions.Count) PeopleTools installation(s):" -ForegroundColor Cyan
    $versions | Format-Table -AutoSize
    
    $vulnerable = $versions | Where-Object { $_.IsVulnerable }
    if ($vulnerable) {
        Write-Host "VULNERABLE: Unpatched PeopleTools installations detected. Apply Oracle patch for CVE-2026-35273 immediately." -ForegroundColor Red
        
        # Check for exploitation indicators
        Write-Host "Checking for signs of potential exploitation..." -ForegroundColor Yellow
        $indicators = Test-PeopleToolsExploitationIndicators
        
        if ($indicators.Count -gt 0) {
            Write-Host "WARNING: Potential exploitation indicators detected:" -ForegroundColor Red
            $indicators | Format-Table -AutoSize
            Write-Host "IMMEDIATE ACTION REQUIRED: Isolate this system and initiate incident response procedures." -ForegroundColor Red
        } else {
            Write-Host "No obvious signs of exploitation detected at this time." -ForegroundColor Green
        }
    } else {
        Write-Host "All installed PeopleTools versions appear to be patched against CVE-2026-35273." -ForegroundColor Green
    }
}

Write-Host "For official Oracle patches and guidance, visit: https://www.oracle.com/security-alerts/" -ForegroundColor Cyan
Write-Host "For CISA KEV requirements, visit: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" -ForegroundColor Cyan