CVE-2026-35276: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Server)

Synopsis

An unauthenticated remote attack vulnerability exists in the Application Server component of Oracle PeopleSoft Enterprise PT PeopleTools (versions 8.61 and 8.62). The flaw is reachable over HTTP without any credentials, though exploitation requires meeting high-complexity conditions. Successful exploitation gives the attacker full control of the PeopleTools instance, including read and write access to all data and the ability to disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleTools Application Server over the network via HTTP; no local or physical access is assumed.

• AuthenticationNot required

  No credentials are needed; the vulnerable endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker does not need any action from a logged-in user or administrator to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must satisfy specific environmental or timing conditions (such as race conditions or particular server state) before the attack reliably succeeds.

Blast Radius

• A successful attacker reads all data accessible to the PeopleTools Application Server, including HR records, financial data, and session tokens stored within the platform.
• The attacker can write or modify persisted data across PeopleTools-managed databases and configuration stores.
• Full process-level takeover of the Application Server is achievable, enabling the attacker to install backdoors or pivot to connected backend systems.
• The attacker can crash or degrade the Application Server, denying access to all PeopleSoft services that depend on it.