What is the CVSS score of CVE-2026-35274?

CVE-2026-35274 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleTools are affected by CVE-2026-35274?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a critical vulnerability (CVE-2026-35274) allowing unauthenticated remote attackers to read and modify data through the…

How to fix or mitigate CVE-2026-35274?

Within 24 hours: isolate or restrict HTTP access to PeopleTools instances running 8.61/8.62 via network controls; block public HTTP exposure immediately. Within 7 days: deploy network segmentation, implement a Web Application Firewall (WAF) blocking HTTP requests to vulnerable endpoints, and audit access logs for suspicious HTTP activity. Within 30 days: coordinate with Oracle for an upgrade path to a patched version; implement mandatory encrypted transport (HTTPS) and IP whitelisting for all PeopleTools instances.

Oracle PeopleTools CVE-2026-35274

EUVD-2026-37404 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Peoplesoft Enterprise Pt Peopletools

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable HTTP endpoint exploitable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N); full read of PeopleTools data (C:H), partial write (I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:21 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PT PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 allows unauthenticated remote attackers to compromise the Deployment Package component over HTTP. The flaw yields complete read access to PeopleTools-accessible data and partial write (insert/update/delete) capability without any user interaction or credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify internet-exposed PeopleSoft PIA

Delivery

Probe Deployment Package HTTP endpoint

Exploit

Send crafted unauthenticated request

Execution

Read PeopleTools-accessible data

Persist

Insert/update/delete subset of records

Impact

Stage follow-on fraud or lateral movement

Access

Identify internet-exposed PeopleSoft PIA

Delivery

Probe Deployment Package HTTP endpoint

Exploit

Send crafted unauthenticated request

Execution

Read PeopleTools-accessible data

Persist

Insert/update/delete subset of records

Impact

Stage follow-on fraud or lateral movement

Vulnerability AssessmentAI

Exploitation	Target must be running Oracle PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 with the Deployment Package component reachable over HTTP from the attacker's network position; no credentials, no user interaction, and no special client configuration are required (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N scores 8.2 (High) and represents a genuinely easy-to-reach issue: network-reachable HTTP, no authentication, no user interaction, low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker scans the internet for PeopleSoft PIA front-ends, identifies a PeopleTools 8.61/8.62 instance, and sends crafted HTTP requests directly to the Deployment Package component without authenticating. They exfiltrate sensitive PeopleSoft data (HR records, financial data, configuration) and selectively insert, update, or delete a subset of records, potentially staging follow-on fraud or persistence. …
Remediation	Patch available per vendor advisory: apply the fixes listed in Oracle's June 2026 Critical Patch Update for PeopleSoft (https://www.oracle.com/security-alerts/cspujun2026.html) to PeopleTools 8.61 and 8.62 environments; Oracle has not published a separate hotfix version in the supplied data, so the CPU bundle is the authoritative remediation. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: isolate or restrict HTTP access to PeopleTools instances running 8.61/8.62 via network controls; block public HTTP exposure immediately. …

Threat intelligence, references, and detailed analysis are available after sign-in.