Bling Libra Exploits Unpatched Oracle PeopleSoft RCE Vulnerability
The Bling Libra threat actor is actively exploiting CVE-2026-35273, a remote code execution vulnerability in Oracle PeopleSoft servers, with education sector organizations being the primary targets since May 2026. This attack demonstrates how threat actors quickly weaponize known vulnerabilities to gain unauthorized access to enterprise systems. The targeting of educational institutions suggests attackers are focusing on organizations that may have slower patch management cycles or limited security resources. Unpatched RCE vulnerabilities in enterprise applications like PeopleSoft can provide attackers with complete system control, leading to data breaches, ransomware deployment, or lateral movement within networks.
Tactical Insight
Immediate actions
- Apply Oracle security patches for CVE-2026-35273 immediately on all PeopleSoft instances
- Scan all Oracle PeopleSoft servers for signs of compromise using appropriate IOCs
- Temporarily restrict network access to PeopleSoft servers until patching is complete
Long-term improvements
- Implement automated vulnerability scanning specifically for Oracle enterprise applications
- Establish emergency patching procedures with defined SLAs for critical RCE vulnerabilities
- Deploy network segmentation to isolate enterprise applications from general network access
Detection measures
- Enable comprehensive logging on all PeopleSoft servers and monitor for unusual administrative activities
- Implement behavioral analysis to detect abnormal authentication patterns and privilege escalations