What is the CVSS score of CVE-2026-35272?

CVE-2026-35272 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle PeopleTools are affected by CVE-2026-35272?

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a vulnerability (CVE-2026-35272) that enables complete system compromise-including full access to confidential data, system…

How to fix or mitigate CVE-2026-35272?

Within 24 hours: Identify all systems running PeopleTools 8.61 or 8.62; audit and document which individuals have OS-level logon privileges to these servers. Within 7 days: Restrict host logon access to PeopleTools servers to named administrators only; enable detailed audit logging on Deployment Package modifications and logon events; implement real-time alerting for suspicious activity. Within 30 days: Execute upgrade to PeopleTools 8.63 or later, or deploy network-level isolation if upgrade timeline extends further.

Oracle PeopleTools CVE-2026-35272

EUVD-2026-37403 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Privilege Escalation

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Local logon required (AV:L) but no PeopleTools auth or user interaction (PR:N/UI:N); Deployment Package abuse yields full takeover, so C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:21 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 is possible via the Deployment Package component, where an unauthenticated attacker with logon access to the underlying host can take over the PeopleTools instance. Oracle rates this 8.4 CVSS with full confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. The local attack vector keeps remote internet-based mass exploitation unlikely, but any user who can log on to the PeopleTools server should be treated as a critical risk.

Technical ContextAI

PeopleTools is the development and runtime middleware layer underpinning Oracle PeopleSoft applications (HCM, Financials, Campus Solutions), and the Deployment Package (DPK) component is the scripted installer/orchestrator used to provision and patch PeopleSoft environments - typically running with elevated rights on app, batch, and database tier hosts. The advisory does not assign a CWE, but the combination of AV:L, PR:N and full C/I/A impact is characteristic of an insecure local interface or privileged process exposed to any logged-on OS user, such as a world-writable script, insecure named pipe, predictable temp file, or service binary callable without authentication. The affected CPE is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_pt_peopletools covering PeopleTools releases 8.61 and 8.62 as shipped by Oracle.

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the vendor-released patch covering PeopleTools 8.61 and 8.62 Deployment Package - exact post-patch build numbers should be taken directly from the CPU patch matrix for your platform. Until the CPU can be deployed, compensating controls focus on the local attack vector: restrict interactive and SSH/RDP logon on PeopleTools app, batch, and PIA tier hosts to a named administrators group (removing developer, batch operator, and integration accounts), tighten filesystem ACLs on the DPK install root and any psadmin/PS_HOME scripts so only the PeopleSoft service account and admins can read/write, and audit sudoers and scheduled tasks that may invoke DPK tooling as a privileged user. These controls will block routine developer self-service on those hosts and may break integration scripts that rely on shared logons, so coordinate with the PeopleSoft admin team before enforcing.