Oracle PeopleSoft Zero-Day Exploited Before Patch; CISA Adds AI App Vulnerabilities

Oracle PeopleSoft Zero-Day Forces Emergency Patching After Exploitation

CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft, allowed unauthenticated remote code execution and was actively exploited before Oracle issued an out-of-cycle security update. The flaw affected one of the most widely deployed ERP and HCM platforms in large enterprises and public sector organizations, where PeopleSoft installations typically manage HR records, payroll, financials, and custom integrations to other business systems.

The emergency patch is Oracle's acknowledgment of material compromise risk. For enterprise buyers, this creates an immediate forcing function: organizations with significant PeopleSoft footprints now have a concrete justification for incremental ERP security spend—application-layer monitoring, ERP-aware detection, and network micro-segmentation—that previously competed with endpoint and identity budgets. The unauthenticated nature of the exploit makes compensating controls mandatory when vendor patch cycles lag exposure windows.

This incident also sharpens the security posture debate between self-managed on-premises ERP platforms like PeopleSoft and SAP versus SaaS-first alternatives like Workday and Microsoft Dynamics 365. SaaS vendors will point to reduced customer patch burden and more consistent hardening, while on-premises buyers face the trade-off of control versus operational overhead. Security vendors specializing in ERP protection—firms that provide application-layer monitoring and privilege minimization for Oracle and SAP environments—gain a stronger narrative for their place in the stack.

For procurement teams, expect new RFP requirements around vendor SLAs for out-of-cycle security updates, time-to-patch metrics, and the availability of compensating controls during exposure windows.

CISA Flags Actively Exploited Flaws in AI Apps and CMS Platforms

On July 7, CISA updated the Known Exploited Vulnerabilities catalog with multiple entries now under active exploitation, including CVE-2026-55255 in Langflow and CVE-2026-48908 in JoomShaper SP Page Builder for Joomla. Both vulnerabilities carry direct implications for enterprise attack surface and budget allocation.

CVE-2026-55255 is an authentication bypass in Langflow, an open-source platform for building LLM applications and AI workflows. The flaw allows unauthenticated access to Langflow instances, creating a path to exfiltrate prompt histories, test data, or connectors, and pivot into backing data sources such as databases, APIs, and vector stores. As enterprises deploy internal copilots and agentic AI tools, exposed Langflow endpoints become high-value targets. The vulnerability reinforces emerging AI security policies: mandatory TLS, authentication, network segmentation, and audit logging for internal LLM tools. Procurement teams will favor vendors with built-in enterprise authentication, SOC-friendly telemetry, and rapid detection updates mapped to KEV entries.

CVE-2026-48908 affects JoomShaper SP Page Builder, one of the top-downloaded Joomla extensions, used across SMB and mid-market web properties. The unrestricted file upload vulnerability enables arbitrary file upload and likely remote code execution on affected Joomla sites. This maps to high real-world attack surface in customer-facing web applications.

KEV-listed vulnerabilities are subject to federal remediation deadlines under Binding Operational Directive 22-01—a 90-day patch or mitigation requirement that many large enterprises use as a de-facto severity bar. These additions directly increase demand for web application firewalls and runtime application self-protection from vendors like Akamai, Cloudflare, F5, and Imperva, which advertise virtual patching for CMS and low-code web stacks. Buyers often re-weight WAF and app-security budgets against endpoint and network controls when KEV updates highlight CMS and AI-app platforms.

Identity-Centric Intrusions Now Account for ~90% of Incidents

Recent incident-response data shows identity-centric intrusions in approximately 90% of cases, with attackers moving faster from initial access to data theft. This shifts control-selection priorities toward identity and access management, privileged access management, and continuous authentication. Organizations with hybrid ERP environments—where PeopleSoft or SAP on-premises systems integrate with cloud identity providers—face particular risk if credential stores or federation trust relationships are not hardened.

For security teams, the combination of KEV updates targeting AI apps and CMS platforms, an actively exploited ERP zero-day, and identity-centric breach patterns creates a forcing function for three budget categories: application security for custom and low-code environments, ERP-specific controls, and identity threat detection. Vendors that ship rapid detections for KEV entries—with explicit SLAs for coverage within 24 to 48 hours—will gain differentiation in EDR, XDR, and WAF procurement cycles.

What to Watch

Track Oracle's cadence of out-of-cycle security updates as a signal of persistent exploitation attempts against PeopleSoft. Monitor vendor responses to the Langflow KEV listing—speed of detection content and compensating control guidance will separate leaders from laggards in the AI security category. For organizations with public-facing Joomla or Langflow deployments, allocate emergency change windows and justify incremental spend on managed WAF and external attack surface management to continuously detect vulnerable CMS or AI endpoints. The shift toward identity-centric breaches means that application-layer vulnerabilities in ERP and AI tools are now identity attack vectors, not just application risks.