What is the CVSS score of EUVD-2026-37416?

EUVD-2026-37416 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle PeopleTools are affected by EUVD-2026-37416?

Oracle PeopleSoft Enterprise versions 8.61 and 8.62 contain a privilege escalation vulnerability (CVSS 8.2) that allows authenticated high-privilege users with local infrastructure access to achieve…

How to fix or mitigate EUVD-2026-37416?

Within 24 hours: Inventory all production systems running PeopleSoft Enterprise 8.61 or 8.62 and restrict local infrastructure access to essential personnel with documented approval. Within 7 days: Evaluate upgrade path to PeopleSoft version 8.63 or later and assess network segmentation for affected systems. Within 30 days: Complete upgrade to unaffected PeopleSoft version or finalize enhanced monitoring and privilege access management controls as interim containment strategy.

Oracle PeopleTools EUVD-2026-37416

| CVE-2026-35288 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Peoplesoft Enterprise Pt Peopletools Privilege Escalation

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Local Deployment Package abuse needs prior high-privileged logon on the PeopleTools host (AV:L, PR:H), is low-complexity with no user interaction, and crosses scope to other PeopleSoft products with full C/I/A impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:28 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full takeover in Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 (Deployment Package component) allows a high-privileged attacker with logon access to the underlying infrastructure to fully compromise PeopleTools with a scope change that impacts additional products. Oracle rates this CVSS 8.2 and confirms it is easily exploitable once the attacker has the required local privileges. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the Deployment Package subsystem of PeopleTools, the middleware/runtime layer that underpins Oracle PeopleSoft applications (HCM, FSCM, Campus Solutions, etc.). Deployment Packages bundle binaries, configuration, and scripts used to install or update PeopleSoft environments, so weaknesses there typically involve trust placed in files, paths, or configuration executed during deployment by privileged service accounts. The CPE confirms the affected component is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_pt_peopletools, and the CVSS scope change (S:C) signals that exploitation crosses the PeopleTools security authority and can affect adjacent PeopleSoft application products that rely on it. No CWE was assigned, so the precise weakness class (e.g., insecure file handling, path or argument injection during deployment) cannot be confirmed from the provided data.

RemediationAI

Apply the fixes delivered in Oracle's June 2026 Critical Patch Update for PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 as documented at https://www.oracle.com/security-alerts/cspujun2026.html (patch available per vendor advisory; exact post-patch build number is not independently confirmed in the provided data, so consult the CPU readme for the precise PeopleTools patch level). Until the CPU is deployed, compensating controls should focus on the PR:H/AV:L precondition: restrict interactive and service logon on PeopleTools application, app server, and Process Scheduler hosts to a minimal set of named admins, rotate and vault credentials for the PSADMIN/deployment service accounts, and tightly control who can place files into or invoke Deployment Package directories (trade-off: tighter ACLs may break ad-hoc patching workflows and require coordination with the PeopleSoft admin team). Enable OS-level auditing on the Deployment Package paths and on PSADMIN/PSAdmin invocations to detect tampering, accepting the additional log volume as the cost.