This vulnerability affects Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 in the Deployment Package component. It allows an unauthenticated attacker who has logon access to the infrastructure where PeopleTools runs to compromise the product, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates local attack vector with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk but could affect application functionality.

Successful exploitation can lead to full compromise of PeopleSoft Enterprise PT PeopleTools, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the PeopleTools environment, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches for CVE-2026-35272. Customers should apply this patch promptly to remediate the vulnerability. Until patched, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle strongly advises remaining on actively supported versions and applying security patches without delay.