What is the CVSS score of CVE-2026-35289?

CVE-2026-35289 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-35289?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 are vulnerable to unauthenticated remote takeover via the Deployment Package component, potentially compromising all…

How to fix or mitigate CVE-2026-35289?

24 hours: Identify and catalog all systems running PT PeopleTools 8.61 or 8.62 in production and non-production environments. 7 days: Implement network segmentation to restrict external access to the Deployment Package component; enable detailed logging and monitoring for suspicious activity. 30 days: Monitor Oracle security advisories for patch release; prepare change management documentation and staged deployment procedures for when a patch becomes available.

PeopleSoft PeopleTools CVE-2026-35289

EUVD-2026-37417 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Authentication Bypass

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable HTTPS deployment endpoint with no auth or user interaction (AV:N/PR:N/UI:N), full takeover impact (C:H/I:H/A:H), and Oracle-stated difficulty justifies AC:H; scope unchanged within PeopleTools.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:28 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 is possible via the Deployment Package component, allowing an unauthenticated network attacker to fully compromise confidentiality, integrity, and availability of the application. Oracle rates this as difficult to exploit (AC:H) but assigns a CVSS 3.1 score of 8.1 due to the complete takeover impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

PeopleSoft PeopleTools is the underlying application development and runtime framework that powers Oracle's PeopleSoft Enterprise suite (HCM, Financials, Campus Solutions, etc.), providing the web/application/batch server tier and administrative tooling. The vulnerable Deployment Package component handles bundling and distribution of PeopleSoft customizations, patches, and application artifacts across environments. The affected CPE is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_pt_peopletools, specifically versions 8.61 and 8.62. CWE is not assigned by Oracle, which is consistent with their advisory practice of not classifying root cause publicly, but the network-reachable HTTPS attack surface combined with full C/I/A impact suggests an unauthenticated remote code execution or authentication bypass in the deployment workflow.

RemediationAI

Patch available per vendor advisory: apply the Oracle June 2026 Critical Patch Update fixes for PeopleSoft PT PeopleTools 8.61 and 8.62 as documented at https://www.oracle.com/security-alerts/cspujun2026.html (exact patched build numbers are listed in the CPU matrix and should be cross-referenced against your current PeopleTools release). Until patching is complete, restrict network reachability to PeopleSoft administrative and Deployment Package endpoints to trusted management networks via firewall ACLs or reverse-proxy allowlists, and place the PeopleSoft web tier behind a WAF tuned to inspect HTTPS traffic to PIA and deployment URIs - be aware this will not stop attacks originating from trusted segments and may interfere with legitimate Change Assistant or Lifecycle Management traffic if rules are too aggressive. Increase logging and alerting on the application server and PIA layers to detect anomalous Deployment Package activity. Avoid exposing PeopleSoft administrative interfaces to the public internet as a longer-term hardening step.