CVE-2026-35279

Remote Code Execution via Performance Monitor in Oracle PeopleSoft Enterprise PT PeopleTools 8.61/8.62

Published Jun 16, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

A flaw in the Performance Monitor component of Oracle PeopleSoft Enterprise PT PeopleTools allows an unauthenticated attacker with network access through HTTP to gain full control over the application. The vulnerability can lead to a complete takeover, compromising confidentiality, integrity, and availability. It is classified as a high‑severity issue with a CVSS v3.1 Base Score of 8.1, indicating that a successful exploit can result in remote code execution and system compromise.

Affected Systems

Affected versions are Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62. Any installation of these releases is vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 8.1 points to significant risk, while the EPSS score of less than 1% suggests that exploitation is not yet widespread. The vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploits. The attack vector is inferred to be remote over HTTP, requiring no authentication, and requires an attacker to be able to send HTTP requests to the application. Successful exploitation would grant the attacker full control over the PeopleSoft instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

PeopleSoft Enterprise PT PeopleTools

affected

Version	Status	Constraints
`8.61`	affected	—
`8.62`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.61:::::::*
	cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.62:::::::*

No data.

Vendor Product Versions

Oracle

Peoplesoft Enterprise Pt Peopletools

Version	Status	Scheme	Platform
`8.61`	affected	generic	—
`8.62`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Oracle PeopleSoft Enterprise PT PeopleTools patch for versions 8.61 and 8.62 as detailed in the Oracle security advisory.
If a patch is not yet available, restrict network access to the PeopleSoft application by firewall rules so that only trusted internal networks can reach the HTTP interface.
Configure the Performance Monitor component to require authenticated access and enforce least privilege if such settings exist.
Monitor application logs for unusual or unauthenticated Performance Monitor requests to detect potential exploitation attempts.

Generated by OpenCVE AI on June 18, 2026 at 23:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.374% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 11:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Remote Code Execution via Performance Monitor in Oracle PeopleSoft Enterprise PT PeopleTools 8.61/8.62

Jun 18, 2026 10:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated Remote Code Execution via Performance Monitor in Oracle PeopleSoft Enterprise PT PeopleTools 8.61/8.62
Weaknesses	CWE-284 CWE-287

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Remote Code Execution via Performance Monitor in Oracle PeopleSoft Enterprise PT PeopleTools 8.61/8.62
Weaknesses		CWE-284 CWE-287 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle peoplesoft Enterprise Pt Peopletools
CPEs		cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.61:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.62:::::::*
Vendors & Products		Oracle Oracle peoplesoft Enterprise Pt Peopletools
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`