Oracle PeopleTools CVE-2026-35274

Target must be running Oracle PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 with the Deployment Package component reachable over HTTP from the attacker's network position; no credentials, no user interaction, and no special client configuration are required (AV:N/AC:L/PR:N/UI:N). Realistic limiting factors: the PeopleTools web tier and specifically the Deployment Package endpoint must be exposed to the attacker (many production deployments restrict PIA and admin interfaces to internal or VPN networks), the instance must be on the affected 8.61/8.62 branches rather than older or already-CPU-patched releases, and the integrity impact is partial (I:L) so an attacker can modify some but not all PeopleTools-accessible data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N scores 8.2 (High) and represents a genuinely easy-to-reach issue: network-reachable HTTP, no authentication, no user interaction, low attack complexity. Oracle explicitly characterizes it as 'easily exploitable,' which aligns with the vector. Counterbalancing signals are limited: no EPSS score was supplied, the CVE is not on CISA KEV, and no public exploit code has been observed, so today this is a high-CVSS issue without confirmed in-the-wild exploitation. Given PeopleSoft's typical deployment as an internet-facing or partner-facing enterprise system holding HR, finance, and student records, the real-world risk skews higher than the absence of KEV/EPSS would suggest, and defenders should not wait for active exploitation before patching. No conflicting data points were observed between description, vector, and CPE.

An attacker scans the internet for PeopleSoft PIA front-ends, identifies a PeopleTools 8.61/8.62 instance, and sends crafted HTTP requests directly to the Deployment Package component without authenticating. They exfiltrate sensitive PeopleSoft data (HR records, financial data, configuration) and selectively insert, update, or delete a subset of records, potentially staging follow-on fraud or persistence. No public exploit identified at time of analysis, but the AC:L/PR:N profile means weaponization once details circulate would be straightforward.