Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-06-11
Score: 9.8 Critical
EPSS: 96.7% High
KEV: Yes
Impact: Authentication Bypass and Potential Takeover of Oracle PeopleSoft Enterprise PeopleTools
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62. It is an authentication bypass identified as CWE‑306 that allows an attacker with network access over HTTP to bypass authentication and gain unauthorized control. Successful exploitation can lead to full compromise of the PeopleSoft instance, exposing sensitive data and disrupting business operations.

Affected Systems

Affected systems are Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. The flaw exists in the Updates Environment Management component.

Risk and Exploitability

The CVSS 3.1 base score is 9.8, with an EPSS score of 97%. The vulnerability is listed in CISA’s KEV catalog, indicating it is likely being exploited. Because it can be triggered via an unauthenticated HTTP request, attackers can potentially compromise multiple systems with minimal effort, given the high exploitation probability.

Generated by OpenCVE AI on October 12, 2026 at 16:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Consult Oracle’s security advisories for any available fixes or updates for PeopleSoft Enterprise PeopleTools 8.61 and 8.62.
  • Restrict HTTP traffic to the Updates Environment Management interface through firewalls or access control lists to prevent unauthenticated access.
  • Configure PeopleSoft logging and actively monitor logs for anomalous requests or signs of exploitation, and respond promptly.

Generated by OpenCVE AI on October 12, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft Enterprise PeopleTools Grants Unauthenticated Access

Thu, 24 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass via HTTP in PeopleSoft Enterprise PeopleTools Leading to Remote Code Execution

Tue, 04 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass via HTTP in PeopleSoft Enterprise PeopleTools Leading to Remote Code Execution

Fri, 31 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in PeopleSoft Enterprise PeopleTools Allows Unauthenticated Remote Code Execution

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in PeopleSoft Enterprise PeopleTools Allows Unauthenticated Remote Code Execution

Mon, 29 Jun 2026 15:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools Enables Full System Takeover

Wed, 24 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools Enables Full System Takeover

Wed, 24 Jun 2026 10:00:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools Allows Remote Code Execution

Wed, 24 Jun 2026 06:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools Allows Remote Code Execution

Wed, 24 Jun 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthorized HTTP-based Exploitation Leading to Remote Code Execution in Oracle PeopleSoft PeopleTools

Tue, 23 Jun 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthorized HTTP-based Exploitation Leading to Remote Code Execution in Oracle PeopleSoft PeopleTools

Tue, 23 Jun 2026 21:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass and Code Execution in PeopleSoft Updates Environment Management

Tue, 23 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass and Code Execution in PeopleSoft Updates Environment Management

Fri, 19 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools 8.61/8.62 Enables Remote Code Execution via HTTP

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle PeopleSoft PeopleTools 8.61/8.62 Enables Remote Code Execution via HTTP

Wed, 17 Jun 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Authentication Bypass Leading to Remote Code Execution in PeopleSoft Enterprise PeopleTools 8.61-8.62

Tue, 16 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Authentication Bypass Leading to Remote Code Execution in PeopleSoft Enterprise PeopleTools 8.61-8.62

Sun, 14 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle PeopleSoft PeopleTools

Sat, 13 Jun 2026 15:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle PeopleSoft PeopleTools

Fri, 12 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*

Fri, 12 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Full Takeover of PeopleSoft Enterprise PeopleTools

Fri, 12 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 12 Jun 2026 17:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-06-12T00:00:00+00:00', 'dueDate': '2026-06-15T00:00:00+00:00'}

Thu, 11 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Full Takeover of PeopleSoft Enterprise PeopleTools

Thu, 11 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Updates Environment Management
Weaknesses CWE-284
CWE-287

Thu, 11 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 11 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools

Thu, 11 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Updates Environment Management
Weaknesses CWE-284
CWE-287

Thu, 11 Jun 2026 03:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-04T03:56:12.603Z

Reserved: 2026-04-01T20:03:40.835Z

Link: CVE-2026-35273

cve-icon Vulnrichment

Updated: 2026-06-11T12:01:10.820Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-11T04:16:53.680

Modified: 2026-07-23T09:10:00.113

Link: CVE-2026-35273

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T16:15:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function