What is the CVSS score of EUVD-2026-37408?

EUVD-2026-37408 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleTools are affected by EUVD-2026-37408?

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a high-severity remote vulnerability in the Performance Monitor component allowing unauthenticated attackers to achieve…

How to fix or mitigate EUVD-2026-37408?

24 hours: Inventory all instances of PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62; immediately restrict HTTP network access to the Performance Monitor component via firewall or WAF rules. 7 days: Contact Oracle for patch timeline and interim guidance; implement network segmentation to isolate affected systems; enable monitoring and alerting on Performance Monitor access. 30 days: Develop upgrade or patching strategy to versions above 8.62 or implement vendor-supplied remediation; verify remediation effectiveness through security testing.

Oracle PeopleTools EUVD-2026-37408

| CVE-2026-35279 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Authentication Bypass

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Performance Monitor is reachable over HTTP without auth (AV:N/PR:N/UI:N); Oracle's 'difficult to exploit' wording supports AC:H; 'takeover' outcome justifies C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:23 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 is possible via the Performance Monitor component, where an unauthenticated network attacker can compromise the application over HTTP. Although Oracle classifies the issue as difficult to exploit (AC:H), successful attacks yield full confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 8.1. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

PeopleTools is the underlying middleware/runtime that hosts PeopleSoft Enterprise applications (HCM, FSCM, CRM, Campus Solutions). The affected Performance Monitor (PPM) component instruments PeopleSoft system performance by collecting metrics from monitored systems and the PIA web tier over HTTP; it exposes web-accessible servlets/endpoints that can be reached on the PeopleSoft Internet Architecture (PIA) without prior authentication in many deployments. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_pt_peopletools confirms the affected product line. No CWE is assigned in NVD data, but the 'takeover' impact combined with the Performance Monitor attack surface is consistent with weaknesses in request handling or deserialization within that component - Oracle does not publish root-cause details in CPU advisories.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update for PeopleSoft (https://www.oracle.com/security-alerts/cspujun2026.html) to PeopleTools 8.61 and 8.62 - Oracle's CPU is the authoritative source for exact PRP/patch IDs, which must be obtained from My Oracle Support. As compensating controls until patching, restrict network access to the Performance Monitor servlets on the PIA web tier (typically reached via /psp or /psc URLs under the PPMI/Performance Monitor path) using the load balancer or web server, place PeopleSoft behind a VPN or zero-trust reverse proxy so HTTP is not internet-reachable, and consider disabling the Performance Monitor agent collection in non-essential environments - the trade-off is loss of PPM-based performance telemetry until the patch is applied. Do not rely on WAF signatures alone given the lack of public technical details.