CVE-2026-35271: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Weblogic)

Synopsis

This is a network-exploitable vulnerability in the WebLogic component of Oracle PeopleSoft Enterprise PT PeopleTools, affecting versions 8.61 and 8.62. An unauthenticated attacker with HTTP access to the server can exploit it without any user interaction, though the attack requires overcoming certain environmental conditions. Successful exploitation gives the attacker full read access to all data the application can reach, as well as the ability to create, modify, or delete critical data, with impact that can extend beyond PeopleTools itself into other connected products. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleTools WebLogic HTTP endpoint over the network; no local or physical access is needed, but the service must be exposed.

• AuthenticationNot required

  No credentials or session token of any kind are required; the attacker can initiate the exploit as an anonymous HTTP client.

• Victim interactionNot required

  The exploit proceeds entirely without any action from a logged-in user or administrator.

• Attack complexityDetail

  The attack is rated High complexity, meaning the attacker must navigate specific environmental conditions, timing constraints, or configuration dependencies before the exploit succeeds reliably.

Blast Radius

• Reads all data accessible to the PeopleTools application, including stored records, credentials, and session material.
• Creates, modifies, or deletes critical data rows within PeopleTools-managed datastores.
• Scope change means a successful attack can pivot to affect other Oracle products or services integrated with the compromised PeopleTools instance.