CVE-2026-35271: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-35271 Overview

CVE-2026-35271 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise PT PeopleTools product, specifically affecting the Weblogic component. The flaw impacts supported versions 8.61 and 8.62. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise PeopleSoft Enterprise PT PeopleTools. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, along with full read access to all data accessible through PeopleTools. The vulnerability is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated network attackers can achieve unauthorized read and write access to all PeopleSoft PT PeopleTools accessible data, with scope change extending impact to additional products.

Affected Products

Oracle PeopleSoft Enterprise PT PeopleTools 8.61
Oracle PeopleSoft Enterprise PT PeopleTools 8.62
Weblogic component bundled with the affected PeopleTools versions

Discovery Timeline

2026-06-17 - CVE-2026-35271 published to the National Vulnerability Database
2026-06-17 - Oracle publishes the Oracle Security Alert June 2026
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-35271

Vulnerability Analysis

The vulnerability resides in the Weblogic component used by Oracle PeopleSoft Enterprise PT PeopleTools. An attacker can reach the vulnerable code path over HTTP without authentication. Although exploitation requires meeting specific conditions that increase attack complexity, a successful attack results in scope change. The attacker's access extends beyond the vulnerable PeopleTools instance and impacts additional connected products and data stores.

The impact targets confidentiality and integrity. An attacker can read sensitive enterprise data managed through PeopleTools and create, modify, or delete records. Availability is not directly affected according to the CVSS vector. The flaw maps to [CWE-284] Improper Access Control, indicating the application fails to enforce access restrictions on a sensitive resource served through Weblogic.

Root Cause

The root cause is improper access control in the Weblogic component shipped with PeopleTools 8.61 and 8.62. Authorization checks fail to validate the requester before granting access to functions or data that should require authenticated, privileged sessions. Oracle has not published specific implementation details for this issue.

Attack Vector

The attack vector is network-based HTTP. An attacker sends crafted HTTP requests to a PeopleSoft application server exposing the affected Weblogic endpoint. No credentials and no user interaction are required. Exploitation complexity is high, meaning the attacker must meet preconditions outside their direct control, such as specific configurations or timing. Public proof-of-concept code is not currently available.

No verified exploit code is published for CVE-2026-35271. Refer to the Oracle Security Alert June 2026 for vendor guidance.

Detection Methods for CVE-2026-35271

Indicators of Compromise

Anomalous HTTP requests targeting Weblogic management or servlet paths on PeopleSoft application servers without valid session tokens
Unexpected creation, modification, or deletion of PeopleTools records originating from non-application user contexts
Outbound connections from PeopleSoft hosts to unknown destinations following inbound HTTP requests on PeopleTools ports

Detection Strategies

Inspect web server and Weblogic access logs for unauthenticated requests reaching restricted PeopleTools endpoints
Correlate database audit events with application-layer authentication logs to identify writes lacking a corresponding authenticated session
Baseline normal HTTP request patterns to PeopleTools and alert on deviations in URI, method, or User-Agent

Monitoring Recommendations

Forward PeopleSoft, Weblogic, and database audit logs to a centralized SIEM for correlation across tiers
Enable verbose access logging on the Weblogic component and retain logs long enough to support post-incident analysis
Monitor outbound traffic from PeopleSoft application servers for signs of lateral movement enabled by the scope change

How to Mitigate CVE-2026-35271

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert June 2026 to PeopleTools 8.61 and 8.62 deployments
Inventory all PeopleSoft Enterprise PT PeopleTools instances and confirm patch status against the June 2026 advisory
Restrict external HTTP access to PeopleSoft application servers using network segmentation and allowlists until patching is complete

Patch Information

Oracle addressed CVE-2026-35271 in the June 2026 Critical Patch Update. Administrators should follow the remediation steps in the Oracle Security Alert June 2026 and validate the patched versions in non-production environments before promoting to production.

Workarounds

Place a web application firewall in front of PeopleSoft to filter requests targeting Weblogic administrative or servlet paths
Limit inbound HTTP access to PeopleTools to trusted internal networks and authenticated VPN users
Disable or remove unused Weblogic applications and endpoints to reduce the exposed attack surface

bash

# Example: restrict inbound HTTP access to PeopleSoft application server
# Replace 10.0.0.0/8 with your trusted management network
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP