Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Manipulation
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the Test Framework component of Oracle PeopleSoft Enterprise PeopleTools, where a low‑privileged attacker with network access via HTTP can ultimately compromise the application. While exploitation requires the cooperation of a user other than the attacker, the resulting breach enables unauthorized creation, deletion, or modification of critical data, thereby directly affecting confidentiality and integrity.

Affected Systems

This flaw affects Oracle Corporation's PeopleSoft Enterprise PeopleTools, specifically versions 8.61 through 8.63. Any deployment of these releases that includes the Test Framework component is vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 8.7 classifies the vulnerability as high‑severity, and the EPSS score indicates a probability of exploitation of less than 1 %. Although it is not listed in the CISA KEV catalog, the requirement for network HTTP access and low technical barriers, combined with potential scope change, make this a significant risk to organizations running the affected PeopleSoft releases.

Generated by OpenCVE AI on October 22, 2026 at 10:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch or upgrade to a fixed PeopleSoft version (8.63 or newer) as detailed in the Oracle CPU Oct 2026 advisory
  • Restrict HTTP traffic to the Test Framework endpoint—use firewall rules or VPN limits to allow access only to trusted staff
  • If the patch cannot be applied immediately, disable or sandbox the Test Framework functionality to prevent exploitation

Generated by OpenCVE AI on October 22, 2026 at 10:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploitation Leading to Unauthorized Data Manipulation in Oracle PeopleSoft PeopleTools Test Framework
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-30T20:01:16.298Z

Reserved: 2026-09-28T15:40:09.480Z

Link: CVE-2026-101431

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:17:51.473

Modified: 2026-11-02T12:50:04.590

Link: CVE-2026-101431

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:30:08Z

Weaknesses