Provenance Record

Well-structured News piece (674 words, within the 400-1200 News range). Clear Overview / What We Know / What We Don't Know / Analysis sections, appropriate technical depth, and careful per-claim attribution with inline source links. Each specific (CVE ID, CVSS, CWE, dates, versions, attribution) is tied to a named outlet rather than asserted flatly.

All 6 source snapshots read from disk (gunzipped); all fetched status_code 200, none failed, none archive-fallback. source-0 (NVD) confirms CVE-2026-35273 base score 9.8 CRITICAL, CWE-306 'Missing Authentication for Critical Function', exact CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, KEV date added 06/12/2026, remediation due 06/15/2026, 'Updates Environment Management' component, and the 'unauthenticated attacker with network access via HTTP' description — all verbatim. source-1 (Rapid7) confirms 'remotely exploitable without authentication', 'remote code execution (RCE)', PeopleTools 8.61/8.62 affected, 'between May 27 and June 9, 2026, predating Oracle's advisory by two weeks', and 'UNC6240 (ShinyHunters), a financially motivated cybercriminal collective' — all verbatim. source-2 (BleepingComputer) confirms 'most of these organizations were based in the United States, and 68 percent operated within the higher education sector' and 'released emergency mitigations to address the flaw, with a patch coming soon' — verbatim; the 68% figure is single-source-cited to BleepingComputer only, correctly. source-3 (Security Affairs) confirms UNC6240/ShinyHunters attribution, 8.61/8.62 confirmed affected, earlier unsupported versions likely vulnerable, and the June 15, 2026 federal remediation deadline. source-4 (Help Net Security) confirms Environment Management Hub (PSEMHUB), the June 10, 2026 advisory date, and the mitigation guidance to disable EMHub or block external access at the network perimeter. source-5 (SecurityWeek) confirms '300 PeopleSoft instances belonging to more than 100 organizations', 'only mitigations have been released by Oracle rather than a full patch', the education-sector-hit-hardest framing, and the Dustin Childs (Zero Day Initiative) quote 'Currently, we're seeing limited exploitation, but our investigation is ongoing' verbatim — single-source-cited to SecurityWeek only, correctly. NOTE: the Oracle security alert and CISA KEV HTML pages are NOT among the cited sources, so no headline/lead claim rests on a bot-blocked 403 URL; the KEV-add date and June 15 federal deadline are both carried by fetchable sources (NVD primary per Rule 9, and Security Affairs).

All headline, summary, and lead specifics verify against the cited snapshots. Two minor recoverable issues found: (1) the phrase 'no patch available' is placed inside quotation marks and attributed to Help Net Security, but that exact string appears zero times in the HNS snapshot — HNS instead says 'there's still no mention of a patch for CVE-2026-35273'. This is a paraphrase rendered as a direct quote (a quote-mark accuracy slip), not a fabricated fact: the substance (no patch at disclosure, only mitigations) is corroborated verbatim by SecurityWeek ('only mitigations have been released by Oracle rather than a full patch') and BleepingComputer ('a patch coming soon'). (2) securityaffairs.com is not on config/source_allowlist.txt; the two claims it carries here (UNC6240 attribution, June 15 deadline) are independently corroborated by Rapid7 and NVD respectively, so the citation is recoverable rather than load-bearing. The Oracle-alert-date framing (June 10) is attributed specifically to Help Net Security and supported by its snapshot; there is no flatly-asserted June 10-vs-June 11 conflict in the article body.

Substantively accurate, well-sourced, and original. The only issues are a single quote-mark misattribution (a paraphrase presented as a direct quote, fully recoverable via a public corrections note) and an off-allowlist but independently-corroborated source. Neither touches the headline, summary, or lead truth. APPROVE_WITH_CORRECTIONS.