This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) affects the Updates Environment Management component. It allows remote unauthenticated attackers to exploit the system over HTTP, potentially resulting in remote code execution and complete takeover of the affected PeopleSoft environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network attack vector with low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's advisory emphasizes the critical nature of this vulnerability and recommends immediate application of mitigations and patches as part of their Critical Patch Update program. The advisory does not specify a fixed version or patch availability explicitly but urges customers to remain on supported versions and apply all security updates without delay.

Successful exploitation can lead to complete compromise of PeopleSoft Enterprise PeopleTools, including remote code execution, resulting in full control over the affected system. This impacts confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread exploitation if unmitigated.

Oracle recommends immediate implementation of the mitigations described in their security alert and applying all Critical Patch Updates, Critical Security Patch Updates, and Security Alerts without delay. Customers should ensure they are running supported versions (8.61 and 8.62) under Premier or Extended Support to receive patches. Oracle's advisory does not explicitly confirm patch availability for this vulnerability but strongly advises upgrading and patching promptly. Review the Oracle advisory at https://www.oracle.com/security-alerts/alert-cve-2026-35273.html for detailed mitigation instructions.