What is the CVSS score of CVE-2026-35272?

CVE-2026-35272 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle PeopleTools are affected by CVE-2026-35272?

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a vulnerability (CVE-2026-35272) that enables complete system compromise-including full access to confidential data, system…

How to fix or mitigate CVE-2026-35272?

Within 24 hours: Identify all systems running PeopleTools 8.61 or 8.62; audit and document which individuals have OS-level logon privileges to these servers. Within 7 days: Restrict host logon access to PeopleTools servers to named administrators only; enable detailed audit logging on Deployment Package modifications and logon events; implement real-time alerting for suspicious activity. Within 30 days: Execute upgrade to PeopleTools 8.63 or later, or deploy network-level isolation if upgrade timeline extends further.

Oracle PeopleTools CVE-2026-35272

EUVD-2026-37403 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Privilege Escalation

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Local logon required (AV:L) but no PeopleTools auth or user interaction (PR:N/UI:N); Deployment Package abuse yields full takeover, so C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:21 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 is possible via the Deployment Package component, where an unauthenticated attacker with logon access to the underlying host can take over the PeopleTools instance. Oracle rates this 8.4 CVSS with full confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain logon on PeopleTools host

Delivery

Locate Deployment Package interface

Exploit

Abuse insecure DPK code path

Execution

Execute code as PeopleTools service account

Impact

Take over PeopleTools instance and pivot to PeopleSoft data

Access

Obtain logon on PeopleTools host

Delivery

Locate Deployment Package interface

Exploit

Abuse insecure DPK code path

Execution

Execute code as PeopleTools service account

Impact

Take over PeopleTools instance and pivot to PeopleSoft data

Vulnerability AssessmentAI

Exploitation	Attacker must already have a logon session (interactive, SSH, RDP, or equivalent) on a host running Oracle PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 with the Deployment Package component installed - the CVSS AV:L vector explicitly rules out network-only exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N with H/H/H impact yields 8.4 and SSVC-style reasoning marks technical impact as total and automatable in principle, but the local attack vector is the dominant limiter - an attacker must already have an interactive or remote logon session on the PeopleTools host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A developer, batch operator, or compromised third-party integration account that already has logon rights to a PeopleTools 8.61/8.62 server abuses an insecure Deployment Package code path to escalate into the PeopleTools service context, then pivots to read or modify configuration, application server credentials, and ultimately the PeopleSoft database. No public exploit is identified at time of analysis, but the AC:L/PR:N profile means once a working technique is published it would be trivially scriptable for any local user.
Remediation	Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the vendor-released patch covering PeopleTools 8.61 and 8.62 Deployment Package - exact post-patch build numbers should be taken directly from the CPU patch matrix for your platform. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running PeopleTools 8.61 or 8.62; audit and document which individuals have OS-level logon privileges to these servers. …

Threat intelligence, references, and detailed analysis are available after sign-in.