CVE-2026-35289: Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package)

Synopsis

This is a high-severity vulnerability in the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools, affecting versions 8.61 and 8.62. An unauthenticated attacker with network access over HTTPS can reach the vulnerable component without any credentials, though exploitation requires meeting certain difficult environmental conditions derived from the high attack complexity rating. Successful exploitation results in full takeover of the PeopleTools instance, including complete loss of confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard tracks the Oracle advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleTools Deployment Package service over the network via HTTPS; there is no local-only or adjacent-only restriction.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is accessible to unauthenticated network requests.

• Victim interactionNot required

  No user action or social engineering is required; the attacker interacts directly with the service.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions or timing constraints beyond simple request crafting before the attack succeeds reliably.

Blast Radius

• A successful attacker reads all data accessible to the PeopleTools application, including HR records, credentials, and session tokens stored within the system.
• A successful attacker modifies or deletes persisted application data and configuration, including deployment packages and associated metadata.
• A successful attacker crashes or renders the PeopleTools service unavailable, disrupting dependent business processes.
• Full system takeover is achievable, giving the attacker persistent control over the affected PeopleTools instance and any resources it can reach.