Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and read of sensitive information
Action: Apply Patch
AI Analysis

Impact

A flaw in the PeopleSoft Enterprise PeopleTools Portal component lets an attacker with a low–privileged account and network access via HTTP modify or read system data. The attacker must obtain assistance from a user other than themselves in order to successfully exploit the weakness. The vulnerability may lead to changes in the confidentiality and integrity of data within the application.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The flaw resides in the Portal component of the PeopleSoft Enterprise PeopleTools suite.

Risk and Exploitability

The CVSS 3.1 base score of 5.4 indicates moderate severity with potential to impact confidentiality and integrity due to a scope change. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, and its exploitation requires human interaction, which may limit the likelihood of automated attacks. Nonetheless, the risk of unauthorized data modification and read warrants timely remediation.

Generated by OpenCVE AI on October 28, 2026 at 23:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch or upgrade to a supported version beyond 8.63.
  • Limit network access to the PeopleSoft Portal and enforce the principle of least privilege for user accounts.
  • Monitor HTTP traffic to the PeopleSoft application for abnormal requests and investigate any suspicious activity promptly.

Generated by OpenCVE AI on October 28, 2026 at 23:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title PeopleSoft Portal Data Modification and Read via HTTP by Low‑Privileged User

Wed, 28 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Attack Allows Data Modification and Read in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284
CWE-285
CWE-639

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Attack Allows Data Modification and Read in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284
CWE-285
CWE-639

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T16:25:09.860Z

Reserved: 2026-09-28T15:40:09.487Z

Link: CVE-2026-101487

cve-icon Vulnrichment

Updated: 2026-11-06T16:24:46.082Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:57.853

Modified: 2026-11-06T17:17:10.233

Link: CVE-2026-101487

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:45:14Z

Weaknesses