CVE-2026-35288: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package)

Synopsis

This is a local privilege escalation and takeover vulnerability in the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools, affecting versions 8.61 and 8.62. An attacker must already have a high-privileged account with local logon access to the infrastructure where PeopleTools runs, but no network exposure or victim interaction is needed. Successful exploitation gives the attacker full control over the PeopleTools instance, with impact that spills beyond the directly affected product into other components on the same host (scope change). HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  A high-privileged (admin-level) account on the local infrastructure is needed before the attack can proceed.

• Victim interactionNot required

  No user interaction is needed; the attacker can execute the exploit entirely without involving another person.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special environmental conditions or timing requirements on the attacker.

Blast Radius

• Reads all data accessible to the PeopleTools process, including credentials, configuration secrets, and application data stored on the host.
• Modifies or destroys PeopleTools application data and configuration, potentially corrupting deployment packages and dependent components.
• Crashes or renders the PeopleTools service unavailable, disrupting dependent business processes.
• Because the scope changes, compromise extends beyond PeopleTools itself to other products or services co-located on the same infrastructure.