CVE-2026-35274 affects Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification (update, insert, delete) of accessible data. The vulnerability has a CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Oracle’s June 2026 Critical Security Patch Update includes patches addressing this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or restricting privileges may reduce risk temporarily but can affect application functionality.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within PeopleSoft Enterprise PT PeopleTools. The attacker may also perform unauthorized update, insert, or delete operations on some accessible data. This compromises confidentiality and partially compromises data integrity. There is no impact on availability reported. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.2.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches for CVE-2026-35274. Customers are strongly advised to apply this update promptly to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation or by removing unnecessary privileges from users. However, these workarounds may disrupt normal application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.