Security · Jun 16
CVE-2026-35273: The PeopleSoft Zero-Day That Made Higher Education's ERP Problem Impossible to Ignore
A CVSS 9.8 flaw in an overlooked administrative component hit over 100 organizations, 68% of them U.S. universities. Here is what defenders can learn.
- Apply Oracle's June 10, 2026 patch for CVE-2026-35273 immediately; PSEMHUB endpoints should not be internet-facing without compensating network controls.
- A CVSS 9.8 in an unmonitored administrative component is more dangerous in practice than one surrounded by controls; context determines real risk.
- Legitimate remote management tools repurposed for persistence bypass many standard detection rules; monitor for anomalous use of trusted software, not just known malicious tooling.