CTIPilot

Oracle PeopleSoft PeopleTools 8.61/8.62 Performance Monitor, missing-auth RCE (CVSS 9.8)

cve · CVE-2026-35278

Coverage timeline
1
first 2026-06-18 → last 2026-06-21
Peak priority
high
1 high
Sources cited
2
2 hosts
Sections touched
1
trending-vulnerabilities
Co-occurring entities
1
see Co-occurring entities below
ATT&CK techniques
1
pinned v19.2 · see below

Hunting pivots

Tags
patch-availablepre-authrcevulnerabilities

ATT&CK techniques

1 technique observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-18/cve-2026-46978-cve-2026-35278-oracle-june-2026-cspu-unauthen · ATT&CK page ↗

Story timeline

  1. 2026-06-18CVE-2026-46978 / CVE-2026-35278, Oracle June 2026 CSPU: unauthenticated Solaris RAD flaw (CVSS 10.0) and PeopleSoft RCE (9.8)
    trending-vulnerabilities

Where this entity is cited

  • trending-vulnerabilities1

Source distribution

  • oracle.com1 (50%)
  • securityweek.com1 (50%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (2)

Entries about Oracle PeopleSoft PeopleTools 8.61/8.62 Performance Monitor, missing-auth RCE (CVSS 9.8) (1)

2026-06-18 · view entry permalink →

HIGHCVE-2026-46978 +1

CVE-2026-46978 / CVE-2026-35278, Oracle June 2026 CSPU: unauthenticated Solaris RAD flaw (CVSS 10.0) and PeopleSoft RCE (9.8)

Oracle's June 2026 Critical Security Patch Update shipped 245 fixes on 2026-06-17, ~100 of them remotely exploitable without authentication (SecurityWeek, 2026-06-17 · Oracle, 2026-06-17). The two standouts for this audience are both pre-auth: CVE-2026-46978 (CVSS 10.0) in the Oracle Solaris 11.4 Remote Administration Daemon (RAD), reachable by an unauthenticated attacker over its default HTTPS management interface, and CVE-2026-35278 (CVSS 9.8), a missing-authentication RCE in PeopleSoft PeopleTools 8.61/8.62 Performance Monitor (T1190). Oracle reports no in-the-wild exploitation at publication; the unauthenticated network vectors warrant emergency prioritisation. Patch internet-facing PeopleSoft and middleware tiers first; as interim hardening, scope the Solaris RAD daemon to localhost where remote administration is not required.

vulnerability18 Jun 05:10Zmulti-sourceOpen finding ↗
Sources: Oracle CSPU advisory · SecurityWeek