This vulnerability in Oracle PeopleSoft Enterprise PT PeopleTools (Deployment Package) affects versions 8.61 and 8.62. It is exploitable remotely over HTTPS by an unauthenticated attacker but is considered difficult to exploit due to the required conditions. Successful exploitation can lead to full compromise of the PeopleSoft Enterprise PT PeopleTools environment, impacting confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-35289 with a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

An unauthenticated attacker with network access via HTTPS could exploit this vulnerability to take over the PeopleSoft Enterprise PT PeopleTools system. This results in high impact on confidentiality, integrity, and availability of the affected system. The vulnerability is difficult to exploit but successful attacks can lead to complete system compromise.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory. No indication exists that the vulnerability is already mitigated or requires no action.