CVE-2026-35288

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle PeopleSoft PT PeopleTools

Publication date: 2026-06-17

Last updated on: 2026-06-24

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-24

Generated

2026-07-08

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-06

NVD

CVE-2026-35288

EUVD

EUVD-2026-37416

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_pt_peopletools	8.61
oracle	peoplesoft_enterprise_pt_peopletools	8.62

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the PeopleSoft Enterprise PT PeopleTools product, specifically in the Deployment Package component, affecting versions 8.61 and 8.62.

It is easily exploitable by a high privileged attacker who already has logon access to the infrastructure where PeopleSoft Enterprise PT PeopleTools runs.

Successful exploitation can lead to a complete takeover of the PeopleSoft Enterprise PT PeopleTools environment.

The vulnerability can also impact additional products beyond PeopleSoft Enterprise PT PeopleTools due to scope change.

Impact Analysis

Exploitation of this vulnerability can result in a full compromise of the PeopleSoft Enterprise PT PeopleTools system.

This includes impacts on confidentiality, integrity, and availability of the system, as indicated by the CVSS score.

An attacker with high privileges could take over the system, potentially affecting additional connected products and services.

Compliance Impact

The vulnerability allows a high privileged attacker to compromise PeopleSoft Enterprise PT PeopleTools, resulting in a takeover of the system with high impacts on confidentiality, integrity, and availability.

Such a compromise could lead to unauthorized access to sensitive data, which may affect compliance with standards and regulations like GDPR and HIPAA that require protection of personal and health information.

However, the provided information does not explicitly describe the direct effects on compliance with these regulations.

Hi! I’m here to help you understand CVE-2026-35288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70