Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
2026-06-12T19:23:48Z•cda02a663989e6f1525991e049fe83250f978378f6cabdd5c0d759d006dce91a
active-exploitationai-assisted-threatsanthropic-project-glasswingauthentication-bypasscheck-pointcriminal-ai-as-a-serviceiot-vpnivanti-sentryoracle-peoplesoftos-command-injectionpatch-tuesday-june-2026peopletoolsrapid7rceremote-code-executionsecurity-advisoryssrfthreat-huntingzero-day
What happened
Rapid7 reported multiple high-impact security developments: an actively exploited Oracle PeopleSoft zero-day (CVE-2026-35273) in PeopleTools 8.61/8.62 allowing unauthenticated remote code execution (CVSS 9.8), classified as an SSRF leading to RCE; two critical Ivanti Sentry vulnerabilities including an unauthenticated OS command injection RCE (CVE-2026-10520, CVSS 10.0) and an authentication-bypass that creates admin accounts (CVE-2026-10523, CVSS 9.9); and a Check Point VPN zero-day (CVE-2026-50751, CVSS 9.3) enabling authentication bypass against IKEv1 configurations, confirmed exploited in‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- cda02a663989e6f1525991e049fe83250f978378f6cabdd5c0d759d006dce91a
- Enrichment time
- 2026-06-12T19:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.