The Q&A — one PeopleSoft question, answered straight
The short answer: Oracle doesn’t give you a number, so set your own and split it in two. For rows that are remotely exploitable without credentials on anything reachable from the internet, I’d plan in days: mitigations within 72 hours of the CPU and the patch in production within two weeks. Everything else can ride your regular window, as long as that window lands before the next CPU.
What changed
Oracle shipped the October CPU on October 20. Its PeopleSoft section had 109 patches, and 41 of them can be exploited remotely without authentication.
On October 27, one week later, the threat intelligence firm Defused reported scanning against CVE-2026-101767, an unauthenticated E-Business Suite flaw from the same CPU, according to BleepingComputer. Oracle hadn’t marked it as exploited. Oracle’s own guidance in that report was to “apply security patches without delay.”
That’s EBS, but PeopleSoft has its own timeline from this year. ShinyHunters exploited CVE-2026-35273 in PeopleTools as a zero-day from May 27 to June 9. Oracle released a Security Alert on June 10. CISA added it to its exploited list on June 12 and gave federal agencies until June 15. In September, Google’s threat team reported a second wave that got past WAF rules by URL-encoding one character of the path. Shadowserver’s honeypots logged attempts as recently as October 28.
So the time from a fix to scanning can be a week, and an old flaw keeps getting tried for months. A quarterly window that starts six weeks after the CPU is a bet that you won’t be on anyone’s list.
The packaging also changed. The first Middleware DPK shipped the week of October 26, after Oracle rebuilt it for three Java releases. With the Builder, your team can build from the patches when they’re posted instead of waiting for Oracle’s package.
What to do, in order
Sort the CPU on day one. Pull the rows that are remotely exploitable without authentication. Mark which of those components are reachable from the internet in your environment, and include the middleware and sign-on tiers in front of PIA.
Put the hot rows on a short clock. Mitigate within 72 hours: block or restrict the endpoint, close T3/IIOP to untrusted hosts, or disable the service if you don’t use it. Then patch production within two weeks.
Treat anything on CISA’s exploited list as an incident. If a PeopleSoft or WebLogic CVE you run lands there, patch now and check for signs of compromise, as Google advised for CVE-2026-35273.
Keep the rest on your regular window, and make sure that window closes before the next CPU on January 19, 2027. The November 17 and December 15 security patch updates are the chances to catch up.
Decide your Middleware DPK path now. If your window can’t wait for Oracle’s package, use the Builder and test the result in non-prod first.
Write the SLA down and report against it. Each CPU, record the date every hot row was mitigated and patched. A missed date gets an owner and a new date, in writing.
My read: The 72-hour and two-week numbers are my own planning defaults, not an Oracle or CISA requirement. Pick numbers your team can actually hit. What matters is that the dangerous rows get their own clock instead of waiting in the quarterly queue.
Who owns it
PeopleSoft technical lead: sorts the CPU on day one and owns the hot-row list.
Middleware and identity teams: apply the WebLogic, Access Manager and Middleware DPK pieces on the same clock.
Security lead: approves the mitigations, watches CISA’s exploited list, and signs off on any delay with an end date.
CIO or IT director: sets the SLA, funds the out-of-cycle window, and asks for the dates every CPU.
For leaders, in one line: Ask your team how many days your worst October PeopleSoft row was exposed, and what number you’ve agreed it should be.
Got a PeopleSoft question? Reply to this email or leave a comment. I’ll pick one for a future Q&A and answer it straight.
Subscribe at peoplesoftcloud.com.
Sources
🔗 Oracle Critical Patch Update Advisory – October 2026 (Oracle, Oct 20, 2026) https://www.oracle.com/security-alerts/cpuoct2026.html
🔗 Hackers now scanning systems for recently-patched Oracle flaw (BleepingComputer, Oct 28, 2026) https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/
🔗 CISA Adds One Known Exploited Vulnerability to Catalog (CISA, Jun 12, 2026) https://www.cisa.gov/news-events/alerts/2026/06/12/cisa-adds-one-known-exploited-vulnerability-catalog
🔗 ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft (Google Cloud / Mandiant, Sep 25, 2026) https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
🔗 KEV entry: CVE-2026-35273 (GCVE, Shadowserver honeypot data, updated Oct 28, 2026) https://db.gcve.eu/known-exploited-vulnerabilities-catalog/29e1d8ee-0f6a-4921-8082-ea90842b66d8
🔗 First Middleware DPK is Available (Oracle / Dan Iverson, Oct 30, 2026) https://blogs.oracle.com/peoplesoft/first-middleware-dpk-is-available