Enterprise app CVE roundup: PeopleSoft, cPanel, Artifactory and Switchvox all need attention

Four high-severity vulnerabilities in widely deployed enterprise software surfaced in the current tracking cycle. None of them have the profile of a Patch Tuesday headline, and all four sit in places where a compromise is expensive.

CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools

PeopleTools is the application framework underneath PeopleSoft HCM and Financials. Organisations that run it are typically large: universities, government agencies, healthcare systems, and enterprises with tens of thousands of employee records.

The exposure characteristic that matters here is self-service. PeopleSoft deployments frequently expose an employee or student self-service portal to the internet so people can check payslips and update details from home. That portal is a front door to a system holding salary data, national identifiers, bank details and dependants' information.

Actions: apply the relevant Oracle Critical Patch Update. Confirm which PeopleSoft components are internet-reachable and whether a WAF sits in front of them. Review administrative account activity for the preceding 90 days.

CVE-2026-41940 — WebPros cPanel & WHM

cPanel and WHM are the control plane for an enormous slice of the shared hosting market. A vulnerability here has an unusual shape: the affected party is usually a hosting provider, but the victims are their customers.

Compromise of WHM means root-equivalent control of a server hosting potentially hundreds of independent websites. Attackers who reach that position typically deploy web shells across every hosted document root, inject SEO spam or skimmers, and harvest the database credentials sitting in every site's configuration file.

Actions: if you operate cPanel, patch and then audit hosted accounts for unfamiliar files, modified configuration and new cron jobs. If you are a hosting customer, ask your provider for their patch status and check your own site for unexpected changes.

CVE-2026-82329 — JFrog Artifactory

This is the one to look at first, and it will get the least attention.

Artifactory is a binary repository manager. It holds build artefacts, caches public packages and serves as the source of truth for what a CI pipeline pulls. An attacker with write access to Artifactory does not need to compromise a single developer workstation. They modify what the build system fetches, and every downstream build compiles their code in.

Artefact repositories are supply chain infrastructure. They deserve the same protection as your source control and your signing keys, and they very rarely get it.

Actions: patch to a fixed release. Audit who and what holds write permission to production repositories — in most organisations this list has accumulated service accounts nobody can account for. Enable artefact signing and verify signatures at deploy time. Review the repository audit log for uploads outside normal build activity.

CVE-2026-9586 — Sangoma Switchvox SQL injection

A SQL injection flaw in Sangoma Switchvox, a VoIP and unified communications platform. SQL injection in 2026 reads like a relic, but appliance-class products with long support tails accumulate exactly this kind of debt.

VoIP infrastructure is a persistent blind spot. It is frequently owned by a facilities or telecoms team rather than IT, excluded from vulnerability scanning because scans disrupt call quality, and left on whatever firmware shipped at install. Meanwhile it holds call detail records, voicemail, directory data and often credentials that unlock other systems — and toll fraud remains a straightforwardly profitable outcome for attackers.

Actions: patch, restrict the management interface to an internal network segment, and put the platform into your regular vulnerability scanning scope even if that means scheduling scans in a maintenance window.

The common thread

All four of these live in the category of software that is critical, widely deployed and owned by somebody other than the security team. PeopleSoft belongs to HR systems. cPanel belongs to hosting operations. Artifactory belongs to platform engineering. Switchvox belongs to telecoms.

That ownership split is why these vulnerabilities sit unpatched for months while Windows gets updated on a two-week cycle. The fix is not technical. It is making sure every one of these systems has a named owner who receives vulnerability notifications and has a defined patching SLA — the same way your Windows estate does.