Oracle PeopleTools CVE-2026-35288

Exploitation requires (1) interactive or service logon to the infrastructure host where PeopleSoft Enterprise PT PeopleTools 8.61 or 8.62 actually executes - typically the PeopleTools application server, Process Scheduler, or PIA mid-tier - and (2) high pre-existing privileges on that host such as the PSADMIN/PeopleSoft service account, a local administrator, or root, as confirmed by the CVSS AV:L and PR:H metrics. The attack specifically targets the Deployment Package component, so the host must be one that produces, stores, or applies Deployment Packages. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the vulnerability cannot be reached over the network, cannot be triggered by ordinary PeopleSoft application end users or low-privilege OS accounts, and is not exploitable on PeopleTools releases other than 8.61 and 8.62 per Oracle.

This is a real but constrained priority. The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H shows that an attacker must already have local logon and high privileges on the host where PeopleTools runs, which substantially limits the population of viable attackers - but once those prerequisites are met exploitation is low-complexity and yields full C/I/A impact plus a scope change to other PeopleSoft products, which is why Oracle scores it 8.2. There is no EPSS score, KEV listing, or public POC in the provided intelligence, so observed exploitation pressure appears low at this time; the SSVC posture is therefore best read as 'not actively exploited, not automatable, total technical impact within and beyond PeopleTools.' The main signal tension is between the high CVSS and the PR:H precondition - for organizations where PeopleTools admins, deployment service accounts, and DBAs are tightly controlled this is a moderate insider/lateral-movement risk; for environments where many operators share elevated access to PeopleSoft mid-tier hosts it should be treated as a high-priority patch.

A PeopleSoft administrator account is compromised through credential theft or a malicious insider abuses their existing access; the attacker logs onto the PeopleTools mid-tier server and manipulates Deployment Package content or invocation to execute attacker-controlled logic under the PeopleTools service identity. Because the vulnerability triggers a CVSS scope change, the attacker then pivots from PeopleTools into the broader PeopleSoft application stack (e.g., HCM or FSCM) to read or alter HR, financial, or student data. No public exploit identified at time of analysis, so any tooling would currently need to be developed by the attacker.