CVE-2026-35289: Oracle PeopleSoft PT PeopleTools Authentication Bypass (CVSS 8.1)

Technical summary

CVE-2026-35289 is a network-accessible authentication bypass or missing authentication check in PeopleSoft Enterprise PT PeopleTools Deployment Package. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack surface, high attack complexity, no privileges required, no user interaction needed, and impacts to all three CIA triad components. The flaw is rooted in CWE-306 (Missing Authentication for Critical Function), suggesting the component fails to properly validate caller identity before executing sensitive operations. Affected versions are limited to 8.61 and 8.62.

Business impact

A successful exploit could grant an attacker unauthenticated control over PeopleSoft deployment infrastructure, potentially enabling lateral movement into HR, financial, or payroll systems that depend on PeopleSoft. This threatens data exfiltration (employee records, financial data), system manipulation (fraudulent transactions, unauthorized access provisioning), and prolonged downtime. Organizations relying on PeopleSoft for mission-critical business processes face operational disruption and regulatory exposure.

Affected systems

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 are affected. Verify your deployment version in the PeopleSoft administration console or via vendor advisory. Versions outside this range and other Oracle PeopleSoft products should be evaluated for exposure through official Oracle security bulletins.

Exploitability

While marked as difficult to exploit (AC:H), the vulnerability requires only network access and HTTPS connectivity—no authentication or user interaction. The high attack complexity suggests the attacker must satisfy non-trivial preconditions (specific timing, crafted payloads, or environmental configuration), but the lack of authentication requirement means reconnaissance and exploitation attempts can be conducted without prior system access. Active in-the-wild exploitation is not yet documented in public KEV catalogs.

Remediation

Consult Oracle's official security advisory for patched versions of PeopleSoft Enterprise PT PeopleTools. Organizations should prioritize upgrading to the latest patched release, which may involve coordinating with PeopleSoft system administrators and scheduling maintenance windows. As an interim control, restrict HTTPS network access to the Deployment Package component to trusted administrative networks where feasible.

Patch guidance

Obtain and apply security patches from Oracle's PeopleSoft security updates page. Verify patch compatibility with your current PeopleSoft configuration and dependent systems before deployment. Test patches in a non-production environment, especially given the criticality of PeopleSoft to HR and financial operations. Coordinate with Oracle support to determine the specific patched version numbers for your affected release (8.61 or 8.62).

Detection guidance

Monitor HTTPS traffic to the PeopleSoft Deployment Package component for unauthenticated requests or unusual payload structures. Implement network-based intrusion detection rules targeting the CWE-306 pattern (calls to sensitive functions lacking authentication checks). Review web application firewall logs and PeopleSoft security audit trails for failed authentication attempts and unexpected deployments. Baseline normal administrative access patterns and flag deviations.

Why prioritize this

Despite difficult exploitability, the CVSS 8.1 score and full CIA impact warrant immediate attention. The unauthenticated network attack vector combined with high-consequence system takeover potential makes this a priority for organizations operating PeopleSoft 8.61 or 8.62 in production. Rapid inventory and patching reduces exposure window before threat actors develop reliable exploits.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH severity) reflects the critical consequence of system compromise balanced against elevated attack complexity. The vector shows an attacker needs only network access to trigger the vulnerability, but the AC:H component indicates obstacles in reliable exploitation—likely requiring specific environmental conditions or multi-step attack chains. This places the vulnerability in the upper-mid risk tier: too dangerous to defer, but not immediately critical if network controls are in place.

Frequently asked questions