What is the CVSS score of CVE-2026-35278?

CVE-2026-35278 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-35278?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a critical remote authentication-bypass vulnerability in the Performance Monitor component, enabling unauthenticated…

How to fix or mitigate CVE-2026-35278?

Within 24 hours: Inventory all systems running PeopleSoft Enterprise PT PeopleTools 8.61-8.62 and assess criticality; restrict network access to Performance Monitor component via firewall rules; disable Performance Monitor service if operationally feasible. Within 7 days: Deploy web application firewall (WAF) rules to block exploitation attempts; enable enhanced logging and alerting on Performance Monitor access; implement network segmentation to isolate affected systems from sensitive networks. Within 30 days: Escalate to Oracle for patch timeline; evaluate upgrade path to patched PeopleTools version; conduct forensic review of Performance Monitor logs for signs of exploitation.

PeopleSoft PeopleTools CVE-2026-35278

EUVD-2026-37407 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP-reachable Performance Monitor flaw yielding takeover, so AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:23 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 is possible via the Performance Monitor component, allowing unauthenticated network attackers to fully compromise confidentiality, integrity, and availability of the application. Oracle rates the issue 9.8 critical and describes it as easily exploitable over HTTP, though no public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.

Technical ContextAI

PeopleTools is the underlying development and runtime framework that hosts Oracle PeopleSoft applications (HCM, Financials, Campus Solutions, etc.), and the Performance Monitor (PPM) is a built-in subsystem that collects runtime telemetry from PeopleSoft application servers via HTTP-based agents reporting to a monitoring servlet. Because PPM exposes HTTP endpoints that accept data from monitored systems, weaknesses in how this component parses or authorizes requests can be reached pre-authentication from any client that can reach the web tier. Oracle has not published a CWE for this advisory, but the combination of unauthenticated network reach plus full C/I/A impact is consistent with deserialization, injection, or authentication-bypass classes commonly seen in Java/Tuxedo-fronted PeopleTools components. The affected CPE is oracle:peoplesoft_enterprise_pt_peopletools restricted to the 8.61 and 8.62 release lines.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to PeopleTools 8.61 and 8.62 as the primary remediation, since no specific fixed patch level is enumerated in the provided data. As a compensating control until patching, disable the Performance Monitor (PPM) collator/servlet in the PeopleTools web profile and remove or restrict the /monitor and /psp PPM endpoints at the web tier, accepting the trade-off of losing runtime performance telemetry. Additionally, place the PeopleSoft web tier behind a WAF or reverse proxy that blocks unauthenticated requests to Performance Monitor URIs and restrict inbound HTTP/HTTPS to known internal monitoring agent IPs, recognizing that this will break PPM agents on systems outside the allowlist.