Analyzing the Impact of CVE-2026-35273: Oracle PeopleSoft PeopleTools Vulnerability in Phishing Attacks

The vulnerability CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools has sparked renewed activity in phishing campaigns targeting organizations using this software for critical operations. With its potential to allow unauthorized access to sensitive company data, threat actors are increasingly exploiting this vulnerability as a core component of their attack vectors.

Observed initially in May 2023, these attacks have largely targeted financial institutions and large corporate entities that rely on Oracle PeopleSoft for enterprise resource planning (ERP). These entities are attractive targets due to the sensitive nature of the data held within these systems. The campaigns, linked to threat groups with a history of targeting ERP systems, capitalize on the security oversight typical in complex environments reliant on legacy applications.

Campaign or TTP Overview

The exploitation of CVE-2026-35273 involves crafted phishing emails purporting to come from legitimate Oracle support channels. The campaign leverages familiar sender domains like oracle-support@company.com and service-oriented subject lines, such as “Critical Update: Action Required to Secure Your Oracle PeopleSoft System.” This particular campaign has been noted for its seemingly personalized approach, integrating organization-specific data in a bid to establish trust with the recipient.

The threat actors initiated these campaigns via compromised email infrastructure, often belonging to small service providers that lack robust security postures. Targeting began promptly in early May 2023, with attacks primarily focusing on entities in North America and Europe, sectors where PeopleSoft’s application prevalence is substantial.

How It Was Built

The infrastructure setup for this campaign was both devious and subtly innovative. The attackers utilized a network of compromised servers to relay phishing emails, making it difficult to trace the origins while bypassing basic sender authentication mechanisms.


HELO: peopletools-update.service

MAIL FROM: oracle-support@trustedservice.org

RCPT TO: john.smith@targetorganization.com

DATA

Subject: Urgent: Required Update for Oracle PeopleSoft

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

To: "John Smith" &lt;john.smith@targetorganization.com&gt;

From: "Oracle Support" &lt;oracle-support@oracle-updates.com&gt;



Dear John,



We have detected a critical vulnerability affecting your Oracle PeopleSoft system. To prevent unauthorized access to your sensitive data, please update your system immediately.



Kindly click on the link below to perform the update:



[Update Now](http://fake-updates.oracle.com/PeopleSoft_Update_053023)



Thank you for your prompt attention to this matter.



Sincerely,

Oracle Support Team



.

The delivery mechanism generally involved HTML emails, loaded with links to cloned update pages that mimicked Oracle’s genuine support portal. By exploiting vulnerabilities in Oracle PeopleSoft, threat actors could deploy scripts for credential harvesting once users interacted with the website.

Why It Worked

Several factors contributed to the success of these campaigns. Notably, the use of legitimate-looking sender domains helped increase click-through rates. Recipients often recognized “oracle-support” as a credible entity, diminishing their suspicion. Additionally, the urgent framing of the email subject line triggered a psychological response in recipients to act quickly without over-scrutinizing the email’s legitimacy.

The lure was enhanced by detailed email personalization. By incorporating specific user data and referencing actual system configurations, the campaign created a sense of legitimacy, making it harder for users to distinguish malicious content from official communication.

Operator Takeaways

As red teamers, this campaign offers valuable lessons in crafting convincing phishing scenarios. To replicate its success, consider leveraging existing knowledge about the target’s systems and infrastructure to build credibility. Ensure that your payload delivery methods are versatile and employ domain spoofing judiciously, as it remains a potent tool against less rigorous inbound email validation filters.

Do’s and Don’ts

Do thoroughly research your target organization to tailor your phishing lures to their specific environment.
Don’t rely solely on generic templates. Personalization increases engagement and credibility.
Do use realistic sender domains that closely mimic legitimate support channels to lower suspicion. This increases the likelihood of your emails reaching the inbox without being flagged as spam.
Don’t forget to consider delivery timing. Attackers exploited this vulnerability mostly within a short window after the vulnerability disclosure, catching many organizations ill-prepared. Time your campaigns to align with plausible events or updates related to your chosen theme.