What is the CVSS score of CVE-2026-35276?

CVE-2026-35276 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-35276?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a critical remote vulnerability enabling unauthenticated attackers to fully compromise the Application Server component,…

How to fix or mitigate CVE-2026-35276?

WITHIN 24 HOURS: Identify all systems running PeopleSoft 8.61/8.62; review access logs for suspicious network activity to the Application Server component. WITHIN 7 DAYS: Implement strict network access controls restricting Application Server HTTP traffic to authorized administrator networks only; disable any internet-facing exposure. WITHIN 30 DAYS: Monitor for Oracle's June 2026 Critical Patch Update (CPU) release; deploy immediately upon availability after testing in non-production environment.

PeopleSoft PeopleTools CVE-2026-35276

EUVD-2026-37406 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Peoplesoft Enterprise Pt Peopletools Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Oracle's vector is consistent with description: remote HTTP reach (AV:N), unauthenticated (PR:N), no UI, but AC:H reflects undisclosed exploitation precondition; full takeover justifies C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:22 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Server). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 is possible via the Application Server component, where an unauthenticated attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates the flaw CVSS 8.1 with high attack complexity, and no public exploit identified at time of analysis. The vulnerability is addressed in Oracle's June 2026 Critical Patch Update (CPU).

Technical ContextAI

PeopleTools is the underlying development and runtime platform for Oracle's PeopleSoft Enterprise applications (HCM, Financials, Campus Solutions, etc.), and the Application Server tier brokers Tuxedo-based service requests between the web tier (PIA) and the database. The affected CPE 'oracle_corporation:peoplesoft_enterprise_pt_peopletools' covers the PeopleTools stack itself rather than any single PeopleSoft module, meaning the flaw is in shared infrastructure used across every PeopleSoft deployment on 8.61/8.62. The CWE was not assigned by Oracle (typical of Oracle CPU advisories), but the combination of unauthenticated HTTP reach, scope:unchanged, and full CIA impact on the App Server is consistent with a server-side request handling or deserialization-class issue in the Tuxedo/JOLT or PIA-to-AppServer path.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (cspujun2026) - see https://www.oracle.com/security-alerts/cspujun2026.html - which is the vendor-released patch for PeopleTools 8.61 and 8.62; Oracle does not assign individual fix version numbers in CPUs, so customers should install the latest PeopleTools patch level identified in the CPU advisory matrix for their release. As a compensating control until patching, restrict inbound HTTP/HTTPS access to the PeopleSoft Internet Architecture (PIA) and Application Server JOLT/Tuxedo listeners to known corporate networks via WAF or network ACLs (trade-off: breaks remote employee/partner access unless VPN-fronted), and enable WAF rules that inspect PIA POST bodies for anomalous serialized payloads (trade-off: possible false positives on legitimate iScript and Integration Broker traffic). Avoid exposing the App Server's Tuxedo/JOLT ports (typically 9000/9033 range) directly to the internet under any circumstance.