Oracle PeopleSoft is facing increased cyberattack activity after attackers began exploiting a critical security vulnerability affecting certain PeopleTools environments. Security researchers say the campaign has expanded to organizations across multiple sectors, increasing the urgency for affected customers to apply available security fixes and review their systems for signs of compromise.

A critical vulnerability in Oracle PeopleSoft is being actively exploited by cybercriminals, according to security researchers tracking the campaign.

The vulnerability, identified as CVE-2026-35273, affects PeopleSoft environments and can potentially allow an attacker to execute commands remotely without first having legitimate access to the system.

The activity has drawn attention because attackers have reportedly adapted their techniques to bypass some security measures that organizations deployed to protect vulnerable PeopleSoft systems.

What is the PeopleSoft vulnerability?

PeopleSoft is enterprise software used by large organizations for functions such as human resources, payroll, finance and other administrative operations.

The vulnerability affects the software’s PeopleTools technology and can provide attackers with a way to interact with a vulnerable system without normal authentication.

In cybersecurity terms, the flaw is particularly serious because it can enable remote code execution, meaning an attacker may be able to make a vulnerable computer perform unauthorized instructions from a remote location.

Oracle has issued security guidance for the vulnerability and recommends that affected customers apply the appropriate fixes and mitigations.

Attackers reportedly bypassed security protections

One of the more significant developments in the campaign is the reported modification of attack techniques.

Organizations had introduced web application firewall (WAF) rules to block malicious requests targeting the vulnerable PeopleSoft component. A WAF acts as a security filter between users and a web application, blocking requests that match known malicious patterns.

According to Google and Mandiant researchers, attackers subsequently modified their requests in a way that could evade certain blocking rules while still being interpreted correctly by the underlying PeopleSoft system.

This demonstrates why simply adding a basic blocking rule may not provide complete protection against an actively exploited vulnerability.

Campaign expands across multiple sectors

The attacks were initially observed against a narrower group of organizations, but researchers have since reported activity involving organizations in several industries.

Reportedly affected or targeted sectors include technology, IT services, healthcare, agriculture, transportation and government.

Researchers have also observed the use of web shells following successful compromises. A web shell is malicious software that can provide an attacker with continued access to a compromised server and allow them to execute commands remotely.

The presence of such tools can indicate that an attacker has moved beyond simply testing or exploiting a vulnerability and has established a foothold within an affected environment.

What organizations using PeopleSoft should do

Organizations running affected PeopleSoft environments should treat the vulnerability as a security priority.

Security teams should first determine whether their PeopleSoft and PeopleTools versions are affected and apply Oracle’s recommended security updates or mitigations.

They should also review web application firewall and other network security rules rather than assuming that an existing rule will block every variation of an exploit attempt.

Monitoring server and application logs for unusual requests, unexpected files, unfamiliar processes and other signs of unauthorized access can also help identify potential compromises.

Organizations that find evidence of exploitation should follow their established incident-response procedures and investigate whether attackers gained persistent access or accessed sensitive information.

Why the development matters

The expanding campaign highlights a broader cybersecurity problem: once a critical software vulnerability becomes publicly known and attackers develop a reliable exploit, organizations can face attacks even after deploying basic defensive measures.

For companies and institutions that rely on PeopleSoft for important business operations, keeping the underlying software updated and monitoring for suspicious activity is therefore particularly important.

The immediate risk is specific to organizations running affected PeopleSoft environments. For the general public, the incident is primarily another example of how vulnerabilities in widely used enterprise software can become targets for large-scale cyberattacks.