CVE-2026-35274: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package)

Synopsis

An unauthenticated network-exploitable vulnerability affects the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. Any attacker with HTTP access to the service can exploit it without any credentials or victim interaction, making it straightforward to trigger at scale. Successful exploitation gives an attacker full read access to all data the application can reach, plus limited ability to write, insert, or delete some of that data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleTools Deployment Package service over the network via HTTP; no physical or local access is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerability is exploitable by a fully unauthenticated attacker.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An attacker reads the full dataset accessible to the PeopleTools application, which can include HR records, payroll data, configuration secrets, and session material.
• An attacker inserts, modifies, or deletes a subset of application data, allowing targeted tampering with records the service can write to.
• No availability impact is rated, so the service itself is not expected to crash or become unavailable as a direct result of exploitation.