Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

A flaw in the PeopleSoft Enterprise PeopleTools product, located in the Tuxedo component, permits an unauthenticated attacker with HTTP network access to read a subset of data that should be protected. The vulnerability does not allow code execution or broad system takeover; its effect is limited to a low‑confidentiality compromise, allowing disclosure of sensitive PeopleSoft data.

Affected Systems

Systems running Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected.

Risk and Exploitability

The CVSS base score of 3.7 reflects a low‑to‑moderate risk with a primary confidentiality impact. An EPSS score of <1% indicates a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request originating from a remote network; if successful, it yields unauthorized read access to limited PeopleSoft data.

Generated by OpenCVE AI on November 3, 2026 at 19:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch for PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63.
  • Restrict HTTP access to PeopleSoft servers, placing them behind a firewall or VPN and limiting exposure to trusted internal networks.
  • Enforce strict authentication and role‑based access controls to ensure that only authorized users can retrieve sensitive PeopleSoft data, mitigating the impact of any residual disclosure.

Generated by OpenCVE AI on November 3, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure via Tuxedo in PeopleSoft Enterprise PeopleTools

Tue, 03 Nov 2026 18:15:00 +0000

Type Values Removed Values Added
Title Remote Data Disclosure in PeopleSoft Enterprise PeopleTools via Unauthenticated HTTP Access
Weaknesses CWE-200

Tue, 03 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Remote Data Disclosure in PeopleSoft Enterprise PeopleTools via Unauthenticated HTTP Access
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T15:57:49.600Z

Reserved: 2026-09-28T15:40:09.479Z

Link: CVE-2026-101417

cve-icon Vulnrichment

Updated: 2026-11-06T15:57:24.091Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:49.847

Modified: 2026-11-06T16:17:05.947

Link: CVE-2026-101417

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T20:00:19Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function