The Q&A — one PeopleSoft question, answered straight
The short answer: Look at your PeopleTools release first. Oracle’s support ends on a published schedule, and once it does, the CPU stops covering you, no matter what your application release is. Next, check that WebLogic, Tuxedo, and Java are versions Oracle delivered in a PeopleTools release or patch. After that, look at delivery formats Oracle is retiring and at the custom code Oracle has never scanned.
What changed
On November 3, Oracle published its recap of RECONNECT Dive Deep. In the security section, it told customers to “periodically review the products and features they use for components that are no longer supported, because those areas are no longer being scanned or patched by Oracle.”
Oracle’s Security Alerts say the same thing in their standard language: product releases outside Premier or Extended Support “are not tested for the presence of vulnerabilities,” and “it is likely that earlier versions of affected releases are also affected.”
That matters this year. CVE-2026-35273, the PeopleTools flaw ShinyHunters exploited from May 27, affects PeopleTools 8.61 and 8.62. Those are the releases Oracle tested. A shop on an older release has no patch and no statement either way.
PeopleTools has its own support policy, separate from the applications. Oracle provides patches for a minor release “until 12 months after the next minor release is made generally available,” and critical patch updates “for up to 24 months.” Oracle has also written that PeopleTools has never offered Extended Support, and that Market Driven Support isn’t offered for it. The applications follow Selective Adoption. Being on 9.2 keeps them current. PeopleTools doesn’t work that way.
What to do, in order
Write down your PeopleTools release and patch level for every environment, production and non-prod. Next to each, write the date patches stop and the date critical patches stop, taken from Oracle’s published support dates. If production and the PUM environment differ, list both.
Check the stack under PeopleTools. Oracle’s policy says WebLogic, Tuxedo and the other required software “must be maintained from a delivered PeopleTools release or patch.” A WebLogic or Java version someone upgraded on their own, outside a delivered DPK, may not be a supported combination. Compare installed versions to what your PeopleTools patch delivered.
Check the delivery formats. Oracle now requires the Middleware DPK for middleware CPUs, and it has said the VirtualBox DPK is being retired. If a PUM lab or build server still depends on either old path, it falls out of the patch stream.
List the features you run that Oracle has retired or replaced. Check them against the Cumulative Feature Overview and the release notes for your release. If a feature you depend on was replaced, it stays on the list until you move off it, with an owner and a date.
Inventory your customizations and bolt-ons. Oracle’s CPU scans and patches Oracle’s code. It has never covered your custom PeopleCode, your App Engines or a third-party add-on. Each one needs an owner who reads its vendor’s advisories, or your own team’s review if no vendor exists.
Repeat it every quarter. Pair it with the January 19, 2027 CPU. Anything that went out of support since the last check gets an upgrade date or a written exception that expires.
My read: A patch report shows what you patched. It doesn’t show what you can no longer patch. That second list is shorter and carries more risk, and it’s the one auditors ask about after an incident.
Who owns it
PeopleSoft technical lead: keeps the release and version inventory and the support dates next to it.
Middleware team: confirms WebLogic, Tuxedo and Java match what PeopleTools delivered.
Application owners: keep the list of retired features and customizations, with an owner for each.
Security lead: treats anything out of support as an open risk with an expiry date.
CIO or IT director: funds the PeopleTools upgrade before the support date, not after it.
For leaders, in one line: Ask your team for the date your PeopleTools release stops getting critical patches, and how long before that date the upgrade is funded.
Got a PeopleSoft question? Reply to this email or leave a comment. I’ll pick one for a future Q&A and answer it straight.
Subscribe at peoplesoftcloud.com.
Sources
🔗 RECONNECT Dive Deep 2026 and the Priorities Shaping PeopleSoft Investment (Oracle / Russell Broom, Nov 3, 2026) https://blogs.oracle.com/peoplesoft/reconnect-dive-deep-2026-and-the-priorities-shaping-peoplesoft-investment
🔗 Staying Current on PeopleTools (Oracle PeopleSoft Blog) https://blogs.oracle.com/peoplesoft/staying-current-on-peopletools
🔗 Oracle Security Alert Advisory – CVE-2026-35273 (Oracle, Jun 10, 2026) https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
🔗 Zero Day Initiative — CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft (Oct 20, 2026) https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft
🔗 First Middleware DPK is Available (Oracle / Dan Iverson, Oct 30, 2026) https://blogs.oracle.com/peoplesoft/first-middleware-dpk-is-available
🔗 Getting Started with Update Image Containers (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/getting-started-with-update-image-containers