CVE-2026-35271: Oracle PeopleSoft WebLogic Unauthenticated Data Access Vulnerability (CVSS 8.7)

Technical summary

This vulnerability in PeopleSoft Enterprise PT PeopleTools is rooted in improper access controls (CWE-284) within the WebLogic component. The attack vector is network-based over HTTP, requires no authentication, and does not depend on user interaction. The attack complexity is rated as high, indicating that specific conditions or system configurations must align for successful exploitation. What distinguishes this flaw is its scope change: while the vulnerability exists in PeopleSoft, a successful compromise can significantly affect additional products in the environment. The impacts include high-severity confidentiality and integrity violations—attackers can both exfiltrate and modify critical data accessible through PeopleSoft Enterprise PT PeopleTools.

Business impact

This vulnerability poses a material risk to organizations relying on PeopleSoft for human capital management, financials, or supply chain operations. Unauthorized data modification could corrupt payroll records, financial transactions, or employee information, leading to operational disruption and potential regulatory violations. The confidentiality impact allows exfiltration of sensitive employee, financial, or vendor data, creating breach notification obligations and reputational harm. Because the scope extends beyond PeopleSoft itself, compromised systems could serve as a pivot point for attackers to access downstream systems, multiplying the blast radius. Organizations should prioritize assessment and patching to prevent this vector from being weaponized in targeted or broad-based attacks.

Affected systems

PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 are confirmed affected. Organizations running these versions with internet-facing or network-accessible WebLogic instances are at direct risk. The scope change notation indicates that downstream systems integrated with or dependent on PeopleSoft data may also be indirectly compromised. Verify your current PeopleSoft version and deployment topology (whether WebLogic endpoints are exposed to untrusted networks) to determine your exposure level.

Exploitability

While the CVSS rating indicates this is difficult to exploit, the combination of network accessibility, no authentication requirement, and no user interaction needed makes it a serious threat. The 'difficult to exploit' classification likely reflects that particular system configurations, application states, or timing conditions must be present, but determined attackers with network access can conduct reconnaissance and targeted exploitation. Given that PeopleSoft systems are often internet-accessible for remote workforce support, this vulnerability should not be underestimated. No public exploit code is currently known to be circulating, but the HIGH CVSS score and detailed nature of the flaw mean security researchers and threat actors alike will likely develop functional proofs-of-concept.

Remediation

Consult Oracle's official security advisory for patched versions of PeopleSoft Enterprise PT PeopleTools that address this flaw. Typically, Oracle releases patches quarterly or more frequently for critical issues; verify the advisory for versions 8.61 and 8.62 that are no longer affected. Pending patch deployment, implement network-based mitigations: restrict HTTP/HTTPS access to PeopleSoft WebLogic endpoints to known, trusted IP ranges or VPN access only. Consider disabling unnecessary WebLogic features or endpoints. Apply defense-in-depth measures including web application firewalls (WAF) rules tuned to detect abnormal data access patterns on PeopleSoft interfaces.

Patch guidance

Check Oracle's official PeopleSoft security advisories and the MyOracle Support portal for patch availability for versions 8.61 and 8.62. Patches are typically released as cumulative updates or security bundles. Before applying, validate patch compatibility with your PeopleSoft environment, including customizations, integrations, and dependent systems. Establish a testing window in a non-production environment that mirrors your production topology. Schedule patching during a maintenance window when PeopleSoft batch processes and integrations can be safely suspended. Verify post-patch functionality, particularly WebLogic connectivity and data-access workflows, before returning systems to production.

Detection guidance

Monitor WebLogic logs and PeopleSoft audit trails for unauthorized data access, modification attempts, or deletion events from unauthenticated or unexpected sources. Inspect network traffic to PeopleSoft endpoints for unusual HTTP requests or repeated access attempts that may indicate reconnaissance. Implement or enhance endpoint detection and response (EDR) on PeopleSoft servers to capture process behavior, memory access patterns, and file modifications. Web application firewall (WAF) logs should be reviewed for probing or exploitation attempts targeting WebLogic administrative interfaces or known vulnerable parameter sets. Correlate alerts across network, application, and database layers to identify multi-stage attacks leveraging this flaw.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (8.7), network accessibility without authentication, and potential for scope creep into downstream systems. Organizations with internet-facing PeopleSoft deployments face the highest risk. The lack of KEV listing does not diminish urgency; rather, it indicates that targeted, organized exploitation may be limited currently, but the window for rapid weaponization is narrow. Delaying patch application increases the probability of opportunistic compromise.

Risk score, explained

The CVSS 3.1 score of 8.7 reflects the following factors: (1) Network Attack Vector—the flaw is exploitable over the network with no physical access required; (2) High Attack Complexity—the difficult-to-exploit nature lowers the score somewhat, suggesting specific conditions must align; (3) No Authentication Required—unauthenticated attackers can trigger the vulnerability; (4) No User Interaction—no victim action is needed to expose the flaw; (5) Scope Change—the impact extends beyond PeopleSoft to other products, elevating severity; (6) High Confidentiality Impact—complete unauthorized disclosure of accessible data; (7) High Integrity Impact—unauthorized modification or deletion of data; (8) No Availability Impact—the flaw does not directly prevent system uptime. The combination of these factors, especially scope change and dual high impacts (C and I), justifies the HIGH severity rating.

Frequently asked questions