CVE-2026-35288

{
  "id": "CVE-2026-35288",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T10:40:21.013",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto PeopleSoft Enterprise PT PeopleTools de Oracle PeopleSoft (componente: Deployment Package). Versiones compatibles que se ven afectadas son 8.61 y 8.62. Vulnerabilidad fácilmente explotable permite a un atacante con altos privilegios con acceso a la infraestructura donde se ejecuta PeopleSoft Enterprise PT PeopleTools comprometer PeopleSoft Enterprise PT PeopleTools. Aunque la vulnerabilidad se encuentra en PeopleSoft Enterprise PT PeopleTools, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de PeopleSoft Enterprise PT PeopleTools. Puntuación Base CVSS 3.1 de 8.2 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "PeopleSoft Enterprise PT PeopleTools",
          "versions": [
            {
              "version": "8.61",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.62",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T00:00:00+00:00",
          "id": "CVE-2026-35288",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7E5859A-0E69-4A6B-A974-31B9C59B881B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.62:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB731E35-FB1C-46AD-9AFD-E52B4FF37A31"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cspujun2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}