CVE-2026-35279: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor)

Synopsis

An unspecified vulnerability in the Performance Monitor component of Oracle PeopleSoft Enterprise PT PeopleTools (versions 8.61 and 8.62) is reachable over HTTP from the network without any authentication. The CVSS vector indicates high attack complexity, meaning exploitation requires the attacker to meet specific environmental or timing conditions before the attack succeeds. Successful exploitation results in full takeover of the PeopleTools instance, affecting confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleTools Performance Monitor service over the network via HTTP; no local or physical access is required.

• AuthenticationNot required

  No credentials or prior account access are needed; the attack is available to any unauthenticated party with network access.

• Victim interactionNot required

  No user interaction is required; the attacker does not need to trick or involve any human on the target system.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific environmental conditions or timing constraints beyond simple connectivity before exploitation succeeds.

Blast Radius

• A successful attacker reads all data accessible to the PeopleTools application, including HR records, financials, and session tokens stored within the instance.
• A successful attacker modifies or destroys data persisted by PeopleTools, including business process configurations, user records, and audit logs.
• A successful attacker crashes or permanently disrupts the PeopleTools service, making it unavailable to all users.
• Because the impact is rated as full takeover, a successful attacker gains the ability to pivot from the compromised PeopleTools instance to other systems it communicates with.