Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Application Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability exists in the PsAdmin component of Oracle PeopleSoft Enterprise PeopleTools, allowing an attacker with physical network access to the system to execute actions that compromise the entire application. The impact includes full compromise of confidentiality, integrity, and availability of the PeopleSoft Enterprise PeopleTools instance. Successful exploitation can result in full takeover of the system without authentication.

Affected Systems

The affected product is Oracle PeopleSoft Enterprise PeopleTools, specifically the PsAdmin component. Versions 8.61 through 8.63 are impacted. The vulnerability applies to installations of PeopleSoft Enterprise PeopleTools running on supported hardware that exposes a physical communication segment.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, with the attack vector being adjacent network (physical network). Because it requires physical access, the likelihood of exploitation is moderate in most environments, but the risk rises sharply if an attacker gains physical proximity. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is not available.

Generated by OpenCVE AI on October 20, 2026 at 23:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or update that addresses this vulnerability for PeopleSoft Enterprise PeopleTools.
  • Restrict physical network access to the servers running PeopleSoft Enterprise PeopleTools; enforce strict segmentation and access controls for the hardware communication ports.
  • Enable comprehensive logging and monitoring of PsAdmin activity, and investigate any anomalous events promptly.

Generated by OpenCVE AI on October 20, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Takeover via Physical Network Access in PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}


Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:42.932Z

Reserved: 2026-09-28T15:40:09.479Z

Link: CVE-2026-101416

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:49.730

Modified: 2026-10-20T22:17:49.730

Link: CVE-2026-101416

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:15:15Z

Weaknesses