What is the CVSS score of CVE-2026-35274?

CVE-2026-35274 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleTools are affected by CVE-2026-35274?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a critical vulnerability (CVE-2026-35274) allowing unauthenticated remote attackers to read and modify data through the…

How to fix or mitigate CVE-2026-35274?

Within 24 hours: isolate or restrict HTTP access to PeopleTools instances running 8.61/8.62 via network controls; block public HTTP exposure immediately. Within 7 days: deploy network segmentation, implement a Web Application Firewall (WAF) blocking HTTP requests to vulnerable endpoints, and audit access logs for suspicious HTTP activity. Within 30 days: coordinate with Oracle for an upgrade path to a patched version; implement mandatory encrypted transport (HTTPS) and IP whitelisting for all PeopleTools instances.

Oracle PeopleTools CVE-2026-35274

EUVD-2026-37404 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Peoplesoft Enterprise Pt Peopletools

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable HTTP endpoint exploitable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N); full read of PeopleTools data (C:H), partial write (I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:21 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PT PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 allows unauthenticated remote attackers to compromise the Deployment Package component over HTTP. The flaw yields complete read access to PeopleTools-accessible data and partial write (insert/update/delete) capability without any user interaction or credentials. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and network reachability make it a high-priority patching target.

Technical ContextAI

Oracle PeopleSoft is a widely deployed enterprise suite for HCM, financials, and campus solutions; PeopleTools is the underlying development and runtime framework that hosts the PeopleSoft Internet Architecture (PIA) over HTTP via WebLogic/Tuxedo. The affected Deployment Package component is responsible for packaging and distributing PeopleSoft application artifacts (DPKs) used during install, patching, and environment provisioning. The CPE coverage (cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_pt_peopletools) and the 'Authentication Bypass' tag, combined with PR:N in the CVSS vector, indicate the Deployment Package endpoint is reachable and actionable without authenticating to PeopleTools. CWE is not assigned, but the impact pattern (high confidentiality, low integrity, no availability) is consistent with an authorization or access-control flaw on an HTTP-exposed Deployment Package endpoint rather than a memory-corruption bug.

RemediationAI

Patch available per vendor advisory: apply the fixes listed in Oracle's June 2026 Critical Patch Update for PeopleSoft (https://www.oracle.com/security-alerts/cspujun2026.html) to PeopleTools 8.61 and 8.62 environments; Oracle has not published a separate hotfix version in the supplied data, so the CPU bundle is the authoritative remediation. Until the CPU can be applied, restrict network access to the PeopleTools Deployment Package endpoints to trusted administrative networks via WAF rules, reverse-proxy ACLs, or firewall segmentation, accepting that this will block legitimate remote DPK distribution workflows and may complicate environment provisioning. Increase web-tier and PIA access logging on Deployment Package URIs and alert on unauthenticated requests, and review existing DPK staging directories for unexpected reads or writes as a compromise check before patching.