Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 2.5 Low
EPSS: n/a
KEV: No
Impact: Limited data exposure through local read access
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the SQR component of Oracle PeopleSoft Enterprise PeopleTools. A low‑privileged attacker who can log on to the infrastructure hosting PeopleSoft can exploit the flaw to read restricted data. The impact is limited to confidentiality; integrity and availability are not affected.

Affected Systems

Affected product is Oracle PeopleSoft Enterprise PeopleTools, specifically the SQR component. Versions 8.61 through 8.63 are impacted. No additional versions are listed.

Risk and Exploitability

The CVSS v3.1 score is 2.5, indicating low severity. The attack vector is local (AV:L) with high attack complexity (AC:H) and low privilege requirement (PR:L). Exploitation requires access to the underlying infrastructure, so remote attackers cannot use it unless they first obtain local credentials. EPSS is not available, and the vulnerability is not in the CISA KEV catalog.

Generated by OpenCVE AI on October 20, 2026 at 22:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch or update to a non‑affected version of PeopleSoft Enterprise PeopleTools.
  • Restrict local logon permissions on the infrastructure that hosts the PeopleSoft database and SQR component, limiting access to trusted administrators only.
  • Implement role‑based access controls and audit trails to detect and prevent unauthorized data reads.

Generated by OpenCVE AI on October 20, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Title Low severity local read‑access vulnerability in PeopleSoft Enterprise PeopleTools SQR component
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:46.148Z

Reserved: 2026-09-28T15:40:09.480Z

Link: CVE-2026-101425

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:50.790

Modified: 2026-10-20T22:17:50.790

Link: CVE-2026-101425

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:00:23Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control