Threats Tagged 'cve-2026-35274'

CVE-2026-35274 is a high-severity vulnerability in Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects the Deployment Package component and has a CVSS 3.1 base score of 8.2, indicating high impact on confidentiality and integrity. Oracle has included patches for this vulnerability in the June 2026 Critical Security Patch Update and strongly recommends applying these patches promptly. Until patched, risk reduction may be possible by blocking required network protocols or restricting privileges, but these mitigations may impact functionality.

CVE-2026-35271 is a high-severity vulnerability in Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity, with a CVSS 3.1 base score of 8.7. Exploitation is difficult but can significantly affect additional products beyond PeopleTools. Oracle has released a Critical Security Patch Update in June 2026 addressing this and related vulnerabilities and strongly recommends applying these patches promptly.