CVE-2026-35272: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package)

Synopsis

A local privilege escalation vulnerability affects the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. An unauthenticated attacker with local logon access to the host where PeopleTools runs can exploit this without any user interaction or special privileges. Successful exploitation gives the attacker full control over the PeopleTools instance, including read, write, and denial-of-service capabilities. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host running PeopleTools; no network path to the service is required.

• AuthenticationNot required

  No account or credentials are required to attempt this exploit; any process with local logon access to the infrastructure is sufficient.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the vulnerability entirely on their own without involving another party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Reads all data accessible to the PeopleTools process, including configuration files, credentials, and application data.
• Modifies or destroys any files and database records the PeopleTools process can write, including deployment artifacts and application configuration.
• Crashes or fully disables the PeopleTools service, making dependent business processes unavailable.
• Achieves full takeover of the PeopleTools instance, which may serve as a pivot point into connected Oracle database backends or adjacent enterprise systems.