14 Days Undetected: What the PeopleSoft Zero-Day Reveals About ERP Monitoring and Incident Response

Executive View

The Oracle PeopleSoft zero-day should not be understood only as a critical vulnerability event. It should be treated as an ERP monitoring and incident response warning, because it exposed how difficult it can be for enterprises to detect suspicious activity inside business-critical application environments before attackers turn access into extortion pressure.

Google Cloud’s Mandiant reported that UNC6240 targeted Oracle PeopleSoft application infrastructure between May 27 and June 9, 2026, creating a 14-day activity window that should concern every CISO responsible for ERP security.¹ 

The campaign exploited CVE-2026-35273, a critical remote code execution vulnerability with a CVSS score of 9.8 in Oracle PeopleSoft PeopleTools. Oracle confirmed that the vulnerability is remotely exploitable without authentication and can result in remote code execution.² 

Rapid7 identified affected PeopleTools versions as 8.61 and 8.62, and stated that exploitation occurred before Oracle’s public advisory, confirming exploitation before Oracle publicly disclosed the vulnerability.³ 

The broader threat environment makes this more urgent. Google Cloud’s M-Trends 2026 reported that the mean time to exploit vulnerabilities dropped to approximately minus seven days, meaning exploitation can occur before patch availability or public disclosure.1 

IBM’s Cost of a Data Breach Report 2025 found that the global average cost of a breach reached $4.44 million, while the average U.S. breach cost reached $10.22 million.4 

For ERP environments that hold payroll, HR, finance, student records, procurement, supplier data, and privileged workflows, delayed detection is not a technical inconvenience. It is a business risk.

CyberTech Intelligence Perspective

CyberTech Intelligence views ERP monitoring as a business resilience capability, not only a security operations function. Oracle PeopleSoft environments support payroll, HR, finance, procurement, student records, regulated data, supplier workflows, and privileged business processes. When suspicious activity remains active across a 14-day window, the issue is not only whether the vulnerability was patched. The larger issue is whether the enterprise can prove what happened, which systems were exposed, which accounts were used, and which business processes may be affected.

According to CyberTech Intelligence research and analysis, the organizations best prepared for ERP incidents will be those that treat monitoring, evidence preservation, privileged access review, and business impact assessment as one response model. ERP security maturity should be measured by detection readiness, investigation confidence, and executive visibility, not by patch status alone.

Why the 14-Day Window Matters

The 14-day activity window highlights a fundamental ERP security challenge. PeopleSoft environments underpin the operational data and business workflows that determine whether employees are paid, invoices are processed, student aid is distributed, vendors are approved, grants are administered, and regulated records remain protected.¹

If attackers maintain access within that environment for days, the incident response challenge extends well beyond confirming whether the vulnerable component was patched. Security leaders need to determine which PeopleSoft endpoints were accessed, which accounts were used, which sensitive data sets may have been queried, which integrations were affected, and whether suspicious activity can be reconstructed with defensible evidence.

IBM's Cost of a Data Breach Report 2025 found that third-party vendor and supply chain compromise averaged $4.91 million per breach and represented 15% of the initial attack vectors studied.⁴ The finding is directly relevant because ERP ecosystems depend on implementation partners, managed service providers, hosting teams, payroll vendors, data integration partners, and external support providers.

The same IBM report found that breaches disclosed by attackers averaged $5.08 million, compared with $4.18 million when internal security teams and tools identified the breach first.⁵ Earlier internal detection gives organizations more time to contain threats, preserve evidence, reduce financial impact, and support informed executive decisions.

CyberTech Intelligence Research Desk Observation 

The PeopleSoft incident reveals a critical ERP security gap: many enterprises have vulnerability management processes, but they do not have ERP attack reconstruction capability.

CyberTech Intelligence’s analyst view is that the next maturity test for ERP security will not be whether an organization can apply an emergency patch. It will be whether the organization can reconstruct attacker activity across the ERP layer with enough speed and confidence to support containment, notification, legal review, executive reporting, and business continuity decisions.

A CVSS 9.8 score confirms technical severity, but it does not confirm incident clarity.¹ Security teams still need to know which PeopleSoft endpoints were reached, which requests were abnormal, which privileged accounts were used, which records were queried, which integrations were accessed, and whether data movement occurred. Without that evidence, leadership is forced to make breach-response decisions from uncertainty.

CyberTech Intelligence believes ERP monitoring must shift from infrastructure availability monitoring to business-critical threat monitoring. The goal is not only to keep PeopleSoft running. The goal is to know when PeopleSoft is being misused, which evidence can confirm or rule out compromise, and how quickly leadership can understand residual business risk. 

Where ERP Monitoring Commonly Breaks Down

Many ERP environments were designed for reliability, workflow integrity, and audit reporting rather than live threat detection. That legacy creates several monitoring blind spots.

The first blind spot is incomplete log coverage. PeopleSoft environments may generate useful telemetry across application servers, web servers, identity systems, databases, middleware, privileged access platforms, endpoint agents, and third-party remote access tools. However, security operations teams may not collect all of those sources in a centralized monitoring environment.

The second blind spot is weak behavioral context. A login may appear normal until it is connected with unusual administrative activity, unexpected Environment Management access, abnormal file reads, or after-hours vendor behavior. ERP monitoring must therefore connect events across identity, application, database, privileged access, and network layers.

The third blind spot is poor retention. IBM reported that supply chain compromise took 267 days on average to identify and contain, including 196 days to identify and 71 days to contain.4

Even though PeopleSoft's zero-day response should move far faster, this benchmark highlights why short log retention windows can leave defenders without enough historical evidence.

The fourth blind spot is ownership fragmentation. ERP administrators, security operations, database teams, identity teams, legal teams, and third-party providers may each control a piece of the evidence. During an incident, that fragmentation slows containment and weakens confidence in executive decisions.

CyberTech Intelligence ERP Monitoring Framework™ 

The CyberTech Intelligence ERP Monitoring Framework™ helps CISOs, CIOs, ERP owners, security operations teams, and risk leaders evaluate whether PeopleSoft monitoring is investigation-ready. It connects ERP application activity, identity telemetry, database evidence, privileged access logs, network signals, and endpoint telemetry into one monitoring model for attack reconstruction. 

This framework should be used as a working model for ERP monitoring coverage. If any layer is missing, the organization may still be able to patch the vulnerability, but it may struggle to prove whether attackers reached sensitive data, used privileged accounts, moved through integrations, or created business impact. 

Incident Response Must Become ERP-Specific

Standard incident response plans often assume that security teams can isolate endpoints, review alerts, collect logs, and contain affected accounts. ERP incidents are more complex because containment decisions may affect payroll runs, finance close, student services, procurement approvals, supplier payments, regulatory reporting, and employee records.

Microsoft’s Digital Defense Report 2025 states that Microsoft observes more than 600 million cybercriminal and nation-state attacks every day across its telemetry.5 

CrowdStrike’s 2026 Global Threat Report found that the average eCrime breakout time fell to 29 minutes, while the fastest observed breakout time was only 27 seconds.6 

These numbers reinforce why ERP incident response cannot be designed during a crisis.

A PeopleSoft incident response plan should define technical and business actions together. Security teams need to know which systems can be isolated, which integrations can be paused, which business owners must approve downtime, which vendors must support forensic review, and which legal or compliance teams must assess notification duties.

ERP Incident Response Flow

Critical ERP Threat Signal or Advisory Identified

↓

Confirm Affected PeopleSoft Assets and PeopleTools Versions

↓

Preserve Web, Application, Identity, Database, Privileged Access, Endpoint, and Network Logs

↓

Search for Suspicious Activity Across the Exposure Window

↓

Review Privileged, Service, Vendor, and Emergency Account Activity

↓

Assess Sensitive Data Access, Integration Activity, and Business Process Impact

↓

Apply Patch, Mitigation, Isolation, or Compensating Controls

↓

Document Evidence, Exceptions, Decisions, and Executive Risk Status

↓

Update Monitoring Rules, ERP Response Playbooks, and Board Reporting 

This flow places evidence preservation before aggressive cleanup because premature containment can destroy the data required to determine breach scope. It also connects technical action with business impact, which is essential when ERP systems support payroll, finance, HR, procurement, regulated records, and third-party workflows. 

The Role of Privileged Access in ERP Breach Response

A PeopleSoft compromise can become materially more damaging when privileged access is poorly governed. ERP systems often include administrators, developers, database administrators, service accounts, integration accounts, batch processing accounts, emergency accounts, and third-party support users. Any one of these account types can increase the blast radius after initial exploitation.

CrowdStrike’s 2026 Global Threat Report found that malware-free activity represented 82% of detections, while attacks by AI-enabled adversaries increased by 89% compared with the prior year.6 

This matters for ERP response because defenders may not see a clean malware alert during a PeopleSoft compromise. They may need to detect unusual administrative activity, unexpected account use, abnormal database access, suspicious vendor sessions, or data staging through legitimate workflows.

For CISOs, the immediate action is to connect ERP vulnerability response with privileged access review. After a critical PeopleSoft advisory, security teams should review privileged users, emergency access, service accounts, vendor accounts, database roles, and authentication logs. That review should occur during the response cycle, not weeks later during an audit.

CyberTech Intelligence ERP Detection Maturity Model™ 

The CyberTech Intelligence ERP Detection Maturity Model™ helps security leaders compare weak and strong ERP monitoring practices across log collection, detection rules, privileged access, retention, response ownership, and executive reporting. It turns ERP monitoring from a technical control discussion into a maturity view that boards and leadership teams can understand. 

This maturity model highlights an important point. ERP monitoring maturity is not defined by tool ownership. It is defined by whether security leaders can produce reliable evidence when the business asks what happened, what was affected, which accounts were involved, and what risk remains. 

What CISOs Should Reassess Now

CISOs should begin with PeopleSoft visibility. Every instance should be mapped by PeopleTools version, hosting model, business process, data sensitivity, exposure status, owner, and monitoring coverage.  

The second priority is log readiness. Security teams should verify whether web logs, application logs, identity events, database audit logs, privileged access logs, endpoint telemetry, and network records are retained long enough to support investigation across the full exposure window.

The third priority is ERP-specific detection engineering. Organizations should create monitoring logic for unusual PeopleSoft endpoint access, unexpected Environment Management activity, abnormal administrative behavior, suspicious service account activity, after-hours vendor sessions, unusual database reads, and outbound data movement.

The fourth priority is third-party access validation. ERP support providers, implementation partners, hosting vendors, and managed service providers may have privileged access that becomes critical during response. Their access should be time-bound, logged, approved, and reviewed after use.

The fifth priority is executive evidence. Verizon’s 2026 Data Breach Investigations Report analyzed more than 31,000 security incidents and more than 22,000 confirmed breaches across 145 countries, showing the scale of breach evidence security leaders must now be prepared to manage.7 

Leadership should receive more than a patch update. They should see which ERP assets were exposed, which logs were reviewed, what suspicious activity was found or ruled out, which accounts were reviewed, which exceptions remain open, and what risk reduction actions are complete.

Executive ERP Monitoring and Response Metrics Dashboard 

These metrics shift the leadership discussion from “Did we patch?” to “Can we prove whether we were exposed, what happened, which evidence supports our conclusion, and what remains at risk?” They also help CISOs explain ERP response readiness in terms boards can evaluate. 

Closing Perspective

The PeopleSoft zero-day shows that ERP security cannot remain limited to patch administration. The 14-day activity window should force a broader reassessment of how enterprises detect, investigate, and contain threats inside systems that support payroll, finance, HR, procurement, regulated records, and third-party workflows.¹

Oracle’s advisory confirms that CVE-2026-35273 is remotely exploitable without authentication and can result in remote code execution.²

CyberTech Intelligence’s conclusion is direct: ERP monitoring must become evidence-driven, business-aware, and response-ready. The organizations most prepared for the next ERP attack will not only patch faster. They will know where to look, what to preserve, which accounts to review, which vendors to involve, which business processes may be affected, and what evidence leadership needs to make confident decisions. ERP resilience will increasingly depend on detection maturity, not patch activity alone. 

Request an ERP Monitoring Assessment

Oracle PeopleSoft security is no longer only a vulnerability management issue. It is an evidence readiness issue involving monitoring coverage, privileged access, third-party support, log retention, detection engineering, incident response ownership, and board-level reporting.

CyberTech Intelligence helps CISOs, CIOs, ERP owners, risk leaders, compliance teams, and enterprise security teams evaluate whether ERP environments are ready for real-world detection, investigation, and response. An ERP Monitoring Assessment can help leadership assess log coverage, validate PeopleSoft monitoring signals, review privileged and vendor access, test ERP incident response readiness, evaluate detection rules, and prepare board-ready monitoring and response metrics.

Request an ERP Monitoring Assessment to understand whether your ERP environment can prove exposure, reconstruct attacker activity, and support confident executive decisions during the next critical advisory.

Security reporting.

Your ERP is your biggest blind spot. It is time to look inside.

References

1. Google Cloud / Mandiant, M-Trends 2026, 2026
   https://cloud.google.com/security/resources/m-trends-executive-edition 
2. Oracle, Security Alert Advisory: CVE-2026-35273, June 2026
   https://www.oracle.com/security-alerts/alert-cve-2026-35273.html 
3. Rapid7, Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273, June 2026
   https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/ 
4. IBM, Cost of a Data Breach Report 2025, 2025
   https://www-api.ibm.com/adobe/assets/urn:aaid:aem:607b9590-38e0-4c91-b433-aa8a17f5b5e8/original/as/cost-of-a-data-breach-2025-full-report.pdf 
5. Microsoft, Microsoft Digital Defense Report 2025, 2025
   https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf? 
6. CrowdStrike, 2026 Global Threat Report, 2026
   https://www.crowdstrike.com/en-us/global-threat-report/ 
7. Verizon, 2026 Data Breach Investigations Report, 2026
   https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf