CVE-2026-35276: Oracle PeopleSoft Authentication Bypass Vulnerability (8.1 CVSS)

Technical summary

CVE-2026-35276 is a missing authentication issue (CWE-306) affecting PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. The Application Server component fails to properly enforce authentication controls on HTTP endpoints, permitting network-based attackers to bypass authentication and execute actions with elevated privileges. The CVSS 3.1 score of 8.1 reflects high impact across all three security dimensions: an attacker can read sensitive data, modify or delete information, and disrupt system availability. The attack vector is network-based, requires no user interaction, and does not require pre-existing authentication or system privileges.

Business impact

Successful exploitation could result in complete takeover of the PeopleSoft environment, exposing an organization to data theft (employee records, payroll, benefits, HR data), unauthorized modifications to HR and financial records, and extended service unavailability. For enterprises relying on PeopleSoft for human capital management, financial management, or supply chain operations, a full compromise poses existential operational and reputational risk. Attackers could pivot within the infrastructure to attack downstream systems or establish persistent footholds for long-term access.

Affected systems

Only PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 are affected. This includes both versions in their entirety; the vulnerability does not distinguish by deployment model or configuration. Organizations running earlier versions (8.60 or lower) or later versions (8.63+) are not affected, pending vendor confirmation in updated security bulletins. On-premises, hosted, and cloud deployments of affected versions require remediation.

Exploitability

Although rated as 'difficult to exploit' per the vulnerability assessment, this does not mean exploitation is unlikely or requires advanced skill. Rather, it indicates specific conditions must be present—such as particular server configurations, network positioning, or authentication state—for successful attack. The fact that no KEV active exploitation has been recorded as of the published date does not guarantee zero real-world attacks; threat actors may exploit opportunistically without public disclosure. Network accessibility is the only barrier; no authentication is required, making reconnaissance and scanning straightforward.

Remediation

Oracle will issue patches for affected versions 8.61 and 8.62. Organizations must apply vendor-provided patches as soon as they are released and validated in a non-production environment. Until patches are available, implement network-level controls to restrict HTTP access to the PeopleSoft Application Server component to trusted sources only (VPN, dedicated subnets, IP whitelisting). Disable or restrict unnecessary HTTP endpoints if the vendor provides guidance. Monitor authentication and application logs for anomalous access patterns.

Patch guidance

Monitor Oracle's official security advisory portal and PeopleSoft product security bulletins for patch releases. Test patches in a staging environment that mirrors production configuration before broad deployment. Versions 8.61 and 8.62 should be prioritized for patching immediately upon availability. If your organization runs versions beyond 8.62, verify that those versions are confirmed unaffected by checking the latest vendor security documentation. Establish a timeline to upgrade off vulnerable versions within 30 days of patch availability or implement compensating controls if upgrades are delayed.

Detection guidance

Monitor for HTTP requests to the Application Server component from unexpected sources or without valid authentication tokens. Alert on: (1) HTTP requests to PeopleSoft endpoints from external or non-whitelisted IP addresses; (2) unusual authentication errors or bypasses in server logs; (3) access to sensitive PeopleSoft endpoints (e.g., HR, financial, or system configuration paths) from unauthenticated sessions; (4) spike in 4xx errors followed by successful requests. Query web access logs for patterns matching the attack vector. Implement web application firewall (WAF) rules to block unauthenticated access to critical endpoints if the vendor provides specific signatures.

Why prioritize this

This vulnerability merits immediate attention because: (1) it allows unauthenticated remote takeover with high impact; (2) it affects core enterprise systems (PeopleSoft) that typically contain sensitive HR, financial, and identity data; (3) successful exploitation gives attackers complete system control, enabling lateral movement and persistence; (4) affected versions are still in active use across many enterprises. Despite no current KEV listing, the ease of exploitation relative to impact justifies highest-priority remediation.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects the combination of: a network attack vector (AV:N), allowing remote exploitation; high attack complexity (AC:H), indicating conditions must align but are not impossible; zero privileges and no user interaction required (PR:N/UI:N), meaning any attacker on the network can attempt it; and high impact across all three security pillars (C:H/I:H/A:H), meaning data can be read, modified, and services disrupted. The score appropriately captures the severity for enterprise deployments; this is not a low-impact flaw.

Frequently asked questions