This vulnerability exists in the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. It is exploitable by an attacker with high privileges and logon access to the infrastructure where PeopleTools executes. Successful exploitation can result in complete compromise of PeopleTools, with confidentiality, integrity, and availability impacts, and may also affect other Oracle products due to scope change. The CVSS 3.1 base score is 8.2, indicating high severity. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability and recommends immediate application to reduce risk.

An attacker with high privileges and logon access to the infrastructure can fully compromise PeopleSoft Enterprise PT PeopleTools, leading to takeover of the product. This includes significant impacts on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products beyond PeopleTools due to scope change. No known exploits in the wild have been reported yet.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches addressing CVE-2026-35288. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be partially mitigated by restricting privileges and access to relevant packages and blocking network protocols required by potential attacks, though these may impact functionality. Patch status is confirmed by the vendor advisory, and no alternative official fixes are indicated.