PeopleSoft PeopleTools CVE-2026-35289

Exploitation targets the Deployment Package component of PeopleSoft PT PeopleTools 8.61 or 8.62, reachable over HTTPS on the PeopleSoft Internet Architecture (PIA) or application-server endpoints exposing deployment functionality; no credentials are required (PR:N) and no user interaction is needed (UI:N). The principal limiting factor is Oracle's High attack-complexity rating, which means successful exploitation depends on conditions outside the attacker's direct control - plausibly a specific deployment/upgrade activity being in progress, a non-default Lifecycle Management configuration, or a timing/race condition in package handling. Organizations that do not expose PeopleSoft web tiers to untrusted networks substantially reduce exposure, and instances on PeopleTools releases prior to 8.61 are not in scope per Oracle's advisory.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows a serious tension: it is unauthenticated and network-reachable with full takeover impact, yet Oracle explicitly rates attack complexity as High, meaning the attacker needs to overcome conditions outside their control (timing, configuration state, or specific environmental factors). There is no EPSS score, no CISA KEV listing, no public POC, and no SSVC decision metadata provided, so the only exploitation signal is the CVSS itself. Real-world risk is meaningful because PeopleSoft is typically internet-exposed for SSO and self-service portals and holds HR, finance, and student data, but the AC:H rating plus absence of known exploitation suggests this is a serious-but-not-imminent patching priority rather than a drop-everything incident. Note that Oracle CPU advisories historically attract reverse-engineering once patches ship, so the window between disclosure and POC can shorten quickly.

An attacker on the internet identifies a PeopleSoft PIA instance via HTTPS banner or favicon fingerprinting, then sends a crafted request to the Deployment Package interface that, under specific server state or configuration, allows them to bypass authentication and execute privileged operations. Because attack complexity is High, the attacker likely needs to win a race condition, predict an internal value, or wait for a specific deployment activity to occur. No public POC has been observed at time of analysis.