PeopleSoft PeopleTools CVE-2026-35278

The PeopleSoft Enterprise PT PeopleTools Performance Monitor component must be reachable by the attacker over HTTP/HTTPS, and the deployment must be running PeopleTools 8.61 or 8.62 with PPM enabled (it is enabled by default on standard PeopleTools web profiles). No authentication, no privileges, and no user interaction are required per the CVSS vector PR:N/UI:N, and attack complexity is Low, so the only practical limit is network reachability of the Performance Monitor URIs - installations that have PPM disabled, restrict the monitoring servlet to internal management networks, or terminate at a WAF that blocks PPM paths are substantially harder to exploit.

All available signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with S:U and C:H/I:H/A:H means a remote, unauthenticated, low-complexity HTTP request yields full takeover, and Oracle's own advisory text labels it 'easily exploitable.' Countering that, the issue is not listed in CISA KEV, no public POC is referenced in the provided intelligence, no EPSS score was supplied, and no CWE/SSVC decision data is available, so weaponization status is currently unknown. The CWE field is N/A and only a single Oracle Critical Patch Update advisory is referenced, so technical root-cause and exploitation tradecraft are not independently corroborated; defenders should treat the 9.8 score as a credible upper bound and prioritize patching even though widespread exploitation has not yet been observed.

An attacker who can reach the PeopleSoft web tier over the internet or an internal network sends a single crafted HTTP request to the Performance Monitor endpoint and, with no credentials or user interaction, obtains takeover-level control of the PeopleTools application, enabling data exfiltration from PeopleSoft modules (HR, finance, student records) and lateral movement into the Oracle database tier. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording and the AV:N/AC:L/PR:N/UI:N vector imply a reliable one-shot exploit is feasible once the bug is reverse-engineered from the CPU patch.