CVE-2026-35273: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management)

Synopsis

An unauthenticated remote takeover vulnerability affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. The flaw is reachable over HTTP from any network without credentials or victim interaction, placing it at the highest exploitability tier. Successful exploitation gives an attacker full control of the PeopleTools instance, including complete read, write, and availability impact. HarborGuard is tracking the advisory for patch availability, as no fix versions have been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the PeopleTools HTTP service over a network; no physical or local access is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is exposed to unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• A successful attacker reads all data accessible to the PeopleTools application, including HR records, credentials, and session tokens stored within the system.
• The attacker can modify or delete persisted data, including configuration, user accounts, and business-critical records managed by PeopleTools.
• The attacker can crash or permanently disable the PeopleTools service, causing a full denial of availability for dependent business processes.
• The combination of full confidentiality, integrity, and availability compromise constitutes a complete takeover of the affected PeopleTools instance.