CVE-2026-35274: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-35274 Overview

CVE-2026-35274 is an authentication weakness in the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools. The flaw affects supported versions 8.61 and 8.62. An unauthenticated remote attacker with network access over HTTP can compromise the product without user interaction. Successful exploitation can yield unauthorized access to critical data, complete read access to all PeopleTools-accessible data, and limited unauthorized update, insert, or delete operations. The weakness is categorized under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can read all PeopleTools-accessible data and modify a subset of it, exposing sensitive enterprise data to remote compromise.

Affected Products

Oracle PeopleSoft Enterprise PT PeopleTools 8.61
Oracle PeopleSoft Enterprise PT PeopleTools 8.62
Component: Deployment Package

Discovery Timeline

2026-06-17 - CVE-2026-35274 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD
2026-06-18 - EPSS scoring data published

Technical Details for CVE-2026-35274

Vulnerability Analysis

The Deployment Package component of PeopleSoft Enterprise PT PeopleTools exposes functionality over HTTP without enforcing authentication. Oracle's advisory characterizes the issue as easily exploitable by a remote, unauthenticated attacker with network access. The result is high confidentiality impact and low integrity impact, with no impact on availability. An attacker who reaches the HTTP interface can retrieve data the deployment component handles and tamper with a limited subset of stored values. Oracle scored the issue 8.2 in its June 2026 Critical Patch Update advisory.

Root Cause

The vulnerability maps to CWE-306: Missing Authentication for Critical Function. A privileged operation exposed by the Deployment Package does not require the caller to authenticate. Any host able to reach the PeopleTools HTTP endpoint can invoke the operation directly.

Attack Vector

Exploitation requires only network reachability to the PeopleTools HTTP service. The attacker sends crafted HTTP requests to the Deployment Package endpoint and receives data or performs writes without supplying credentials. No user interaction is required, and the attack does not cross a privilege boundary because no privileges are required to begin with. Internet-exposed PeopleSoft instances are at highest risk, but lateral movement from a compromised internal host is equally viable.

No verified public exploit code is currently available. Refer to the Oracle Security Alert 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-35274

Indicators of Compromise

Unauthenticated HTTP requests to Deployment Package URIs in PeopleTools web server access logs
Anomalous data export volumes from PeopleTools application servers to external or unexpected internal IPs
HTTP 200 OK responses to requests lacking a valid session cookie or authentication header
Unscheduled modifications to deployment package metadata or configuration tables

Detection Strategies

Inspect WebLogic and PeopleTools web server access logs for requests to deployment-related endpoints that succeed without prior authentication
Correlate database audit events showing inserts, updates, or deletes attributed to the deployment service account with originating HTTP request IDs
Baseline normal administrator workflows for the Deployment Package and alert on requests originating from non-administrative subnets

Monitoring Recommendations

Forward PeopleSoft application and web server logs to a centralized SIEM with PeopleTools-specific parsers
Enable database-level auditing on PeopleTools metadata tables touched by the Deployment Package
Monitor for outbound HTTP responses with unusually large payloads from PeopleTools servers, which may indicate bulk data extraction

How to Mitigate CVE-2026-35274

Immediate Actions Required

Apply the fixes from the Oracle June 2026 Critical Patch Update on all PeopleTools 8.61 and 8.62 deployments
Restrict network reachability of PeopleTools HTTP endpoints to trusted administrative networks and VPN ranges
Review web server and database audit logs for evidence of unauthenticated access to the Deployment Package since the affected versions were deployed

Patch Information

Oracle has issued patches as part of the June 2026 Critical Patch Update. Customers must consult the Oracle Security Alert 2026 for the relevant patch identifiers, prerequisites, and installation guidance for PeopleTools 8.61 and 8.62.

Workarounds

Place PeopleTools web servers behind a reverse proxy that enforces authentication or mutual TLS for Deployment Package URIs
Use a web application firewall to block requests to deployment endpoints that lack expected session or authentication headers
Limit exposure of administrative interfaces to dedicated management VLANs until patches are installed

bash

# Example reverse proxy restriction for Deployment Package endpoints
location /deployment/ {
    allow 10.10.20.0/24;   # admin subnet
    deny all;
    auth_request /auth/validate;
    proxy_pass http://peopletools_backend;
}