Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

Vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61‑8.63) allows an unauthenticated attacker who can reach the application over HTTP to cause the system to hang or crash repeatedly, resulting in a full denial of service. The weakness provides only availability impact with no compromise of confidentiality or integrity. It is classified as a DoS flaw and is captured by CWE-754 and CWE-400.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools version 8.61, 8.62 and 8.63 are affected. These releases deploy the Business Interlink component that is responsible for historical data sharing. All installations of PeopleTools running these major releases on any platform via the HTTP interface are at risk.

Risk and Exploitability

The CVSS 3.1 base score of 5.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, so no public exploit evidence is known. The attack vector is remote over HTTP, requiring no authentication, and an attacker must only send crafted requests to the Vulnerable Business Interlink endpoint. While the impact is limited to availability, the lack of authentication and remote nature make it moderately exploitable from the network level.

Generated by OpenCVE AI on October 20, 2026 at 23:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle PeopleSoft Enterprise PeopleTools patch that addresses the Business Interlink denial‑of‑service flaw (recommended upgrade to 8.63.1 or later).
  • Restrict HTTP traffic to the PeopleTools instance by implementing firewall or access‑control rules that allow only trusted administrative networks to reach the Business Interlink endpoint.
  • If the patch cannot be applied immediately, disable or block the Business Interlink component via configuration to prevent exposure to the vulnerability.

Generated by OpenCVE AI on October 20, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Denial of Service in PeopleSoft Enterprise PeopleTools Business Interlink
Weaknesses CWE-400
CWE-754

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:33.087Z

Reserved: 2026-09-28T15:40:09.476Z

Link: CVE-2026-101389

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:46.637

Modified: 2026-10-20T22:17:46.637

Link: CVE-2026-101389

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:30:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-754

    Improper Check for Unusual or Exceptional Conditions