Oracle PeopleTools CVE-2026-35272

Attacker must already have a logon session (interactive, SSH, RDP, or equivalent) on a host running Oracle PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 with the Deployment Package component installed - the CVSS AV:L vector explicitly rules out network-only exploitation. No authentication to PeopleTools itself is required (PR:N) and no user interaction is needed (UI:N), so any unprivileged OS account on the PeopleTools server is sufficient. Limiting factors: the bug does not apply to PeopleTools releases other than 8.61 and 8.62, it cannot be triggered from a remote network position without first obtaining host logon, and environments that restrict PeopleTools servers to a small admin group materially reduce the exploitable population.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N with H/H/H impact yields 8.4 and SSVC-style reasoning marks technical impact as total and automatable in principle, but the local attack vector is the dominant limiter - an attacker must already have an interactive or remote logon session on the PeopleTools host. There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so this is not a drive-by internet threat; it is, however, a textbook privilege-escalation/takeover primitive on a high-value middleware host that often has shared OS accounts, batch users, and DBA access. Real-world priority should be high for organizations where non-administrative users (developers, batch operators, third-party integrators, jump-host users) can log on to PeopleTools servers, and moderate where those hosts are tightly restricted to a small admin group. No conflicting signals were observed in the supplied data beyond the absence of CWE and EPSS, which should be revisited once MITRE/NVD enrichment lands.

A developer, batch operator, or compromised third-party integration account that already has logon rights to a PeopleTools 8.61/8.62 server abuses an insecure Deployment Package code path to escalate into the PeopleTools service context, then pivots to read or modify configuration, application server credentials, and ultimately the PeopleSoft database. No public exploit is identified at time of analysis, but the AC:L/PR:N profile means once a working technique is published it would be trivially scriptable for any local user.