Oracle PeopleTools CVE-2026-35271

Exploitation requires only network-reachable HTTP access to a PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 deployment whose WebLogic-fronted endpoints are exposed to the attacker - no credentials, no user interaction, and no specific non-default configuration are called out by Oracle. Limiting factors are the high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control such as specific request timing, server state, or version-specific paths, and the fact that many PeopleSoft tenants are deployed behind VPNs or SSO reverse proxies rather than directly on the public internet, which materially reduces the exploitable population.

Signals are mixed and tilt toward 'high priority but not emergency.' CVSS 3.1 is 8.7 with AV:N/PR:N/UI:N - i.e., remotely reachable without credentials or user interaction - and the S:C scope change with C:H/I:H means a single successful attack can pivot data access beyond PeopleTools, which is significant for enterprise deployments holding HR and finance data. Tempering that, AC:H indicates Oracle considers exploitation non-trivial (special conditions or timing beyond the attacker's control), A:N means no availability impact, and there is no EPSS score, no KEV listing, and no public POC referenced - so widespread opportunistic exploitation is unlikely in the near term. The Authentication Bypass tag aligns with PR:N and increases the chance that a working exploit, once developed, would be reliable, so internet-exposed PeopleSoft tenants should treat this as a high-priority patch rather than wait for KEV confirmation. No CWE was published and no independent advisory beyond Oracle's CPU exists yet, so technical details are limited to what Oracle disclosed.

An attacker on the internet identifies an exposed PeopleSoft portal, fingerprints the PeopleTools/WebLogic stack, and sends a crafted HTTP request that bypasses authentication on a privileged PeopleTools endpoint; because scope changes, the request reaches data managed by other PeopleSoft modules (e.g., HCM or FSCM) and the attacker reads or modifies HR, payroll, or financial records. No public POC has been published at time of analysis, and the AC:H rating implies the attacker needs some reconnaissance or precise request crafting to make the bypass succeed reliably.