CVE-2026-35273 Security Assessment Report
Oracle PeopleSoft PeopleTools RCE
Executive Summary
Total Targets
{len(all_results)}
Critical Risk
{sum(1 for r in all_results if r['risk_level'] == 'CRITICAL')}
High Risk
{sum(1 for r in all_results if r['risk_level'] == 'HIGH')}
Vulnerable Versions
{sum(1 for r in all_results if '8.61' in str(r['version_hints']) or '8.62' in str(r['version_hints']))}
⚠️ CVE-2026-35273 Critical Information:
• Vulnerability Type: Unauthenticated Remote Code Execution (RCE)
• Affected Versions: PeopleTools 8.61, 8.62
• Attack Vector: HTTP/HTTPS
• CVSS Score: 9.8 (Critical)
• Patch Status: Oracle out-of-band patch available
Detailed Scan Results
| Target |
Risk Level |
CVE-2026-35273 |
PSEMHUB Endpoints |
Version Info |
Path Traversal |
"""
for result in all_results:
risk_class = result['risk_level'].lower()
psemhub_count = sum(1 for p in result['endpoints'] if "PSEMHUB" in p)
is_vulnerable = "VULNERABLE" if result['risk_level'] in ["CRITICAL", "HIGH"] else "Not Vulnerable"
vuln_color = "#d32f2f" if is_vulnerable == "VULNERABLE" else "#4caf50"
html += f"""
| {result['target']} |
{result['risk_level']} |
{is_vulnerable} |
{psemhub_count} |
{', '.join(result['version_hints']) if result['version_hints'] else 'Not detected'} |
{'Yes' if result['traversal_vulnerable'] else 'No'} |
"""
html += f"""
"""
return html
def main():
parser = argparse.ArgumentParser(description='CVE-2026-35273 - Oracle PeopleSoft PeopleTools RCE Scanner')
parser.add_argument('-t', '--target', help='Single target URL')
parser.add_argument('-f', '--file', help='Targets file (targets.txt)')
parser.add_argument('-o', '--output', help='Output file for results (JSON lines format)')
parser.add_argument('--format', choices=['json', 'csv', 'html'], default='json', help='Output format for batch scan')
parser.add_argument('-v', '--verbose', action='store_true', help='Verbose output with detailed simulation')
parser.add_argument('-T', '--threads', type=int, default=5, help='Number of threads for batch scanning (default: 5)')
parser.add_argument('--timeout', type=int, default=12, help='Request timeout in seconds (default: 12)')
args = parser.parse_args()
# Print CVE-2026-35273 banner
print_cve_banner()
# Single target mode
if args.target:
target = args.target.strip()
if not target.startswith(('http://', 'https://')):
target = 'https://' + target
safe_print(f"[*] Scanning target: {target}", Colors.CYAN)
safe_print(f"[*] CVE: CVE-2026-35273")
safe_print(f"[*] Mode: Detection + Safe PoC Simulation")
safe_print(f"[*] Timeout: {args.timeout} seconds per request\n")
results = scan_target(target, args.verbose, args.output)
# Final disclaimer
safe_print(f"\n{Colors.BOLD}{'=' * 70}{Colors.RESET}")
safe_print(f"{Colors.RED}[DISCLAIMER]{Colors.RESET}")
safe_print("This tool is for EDUCATIONAL PURPOSES and AUTHORIZED TESTING only.")
safe_print("The PoC simulation is THEORETICAL and does NOT execute any actual exploits.")
safe_print("CVE-2026-35273 is a CRITICAL vulnerability - patch immediately if vulnerable.")
safe_print("Unauthorized use against systems you do not own or have permission to test")
safe_print("is ILLEGAL and violates computer fraud laws.")
safe_print(f"{Colors.BOLD}{'=' * 70}{Colors.RESET}\n")
scan_id = hashlib.md5(f"CVE-2026-35273-{target}{time.time()}".encode()).hexdigest()[:8]
safe_print(f"{Colors.CYAN}CVE-2026-35273 Scan ID: {scan_id} (use for reference){Colors.RESET}\n")
# Batch mode
elif args.file:
targets = load_targets(args.file)
if not targets:
safe_print("[-] No targets loaded. Exiting.", Colors.RED)
sys.exit(1)
safe_print(f"[*] Loaded {len(targets)} targets from {args.file}", Colors.CYAN)
safe_print(f"[*] CVE: CVE-2026-35273")
safe_print(f"[*] Threads: {args.threads}")
safe_print(f"[*] Timeout: {args.timeout} seconds\n")
all_results = []
# Use ThreadPoolExecutor for concurrent scanning
with ThreadPoolExecutor(max_workers=args.threads) as executor:
future_to_target = {executor.submit(scan_target, target, args.verbose, args.output): target for target in targets}
if HAS_TQDM:
with tqdm(total=len(targets), desc="CVE-2026-35273 Scanning", unit="target") as pbar:
for future in as_completed(future_to_target):
try:
result = future.result()
all_results.append(result)
pbar.update(1)
except Exception as e:
safe_print(f"[-] Error scanning target: {e}", Colors.RED)
pbar.update(1)
else:
for future in as_completed(future_to_target):
try:
result = future.result()
all_results.append(result)
except Exception as e:
safe_print(f"[-] Error scanning target: {e}", Colors.RED)
# Save batch results
save_batch_results(all_results, args.format)
# Print summary
safe_print(f"\n{Colors.BOLD}{'=' * 70}{Colors.RESET}")
safe_print(f"{Colors.BOLD}CVE-2026-35273 BATCH SCAN SUMMARY{Colors.RESET}")
safe_print(f"{Colors.BOLD}{'=' * 70}{Colors.RESET}")
safe_print(f"Total Targets: {len(all_results)}")
safe_print(f"Critical Risk (Vulnerable): {sum(1 for r in all_results if r['risk_level'] == 'CRITICAL')}")
safe_print(f"High Risk (Potentially Vulnerable): {sum(1 for r in all_results if r['risk_level'] == 'HIGH')}")
safe_print(f"Medium Risk: {sum(1 for r in all_results if r['risk_level'] == 'MEDIUM')}")
safe_print(f"Low Risk: {sum(1 for r in all_results if r['risk_level'] == 'LOW')}")
vulnerable_count = sum(1 for r in all_results if r['risk_level'] in ['CRITICAL', 'HIGH'])
if vulnerable_count > 0:
safe_print(f"\n{Colors.RED}[!] {vulnerable_count} targets are potentially vulnerable to CVE-2026-35273!{Colors.RESET}")
safe_print(f"{Colors.RED}[!] Apply Oracle patches immediately!{Colors.RESET}")
else:
parser.print_help()
sys.exit(1)
if __name__ == "__main__":
main()