Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Monitor
AI Analysis

Impact

A vulnerability exists in the Portal component of Oracle PeopleSoft Enterprise PeopleTools that permits a low‑privileged attacker with network access via HTTP to read data that should be restricted, impacting confidentiality. The flaw provides unauthorized data read access and is considered easily exploitable, though it does not compromise integrity or availability.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are vulnerable. Systems running any of these releases are exposed to the documented read‑access weakness.

Risk and Exploitability

The CVSS v3.1 base score of 4.3 reflects a moderate confidentiality risk. The attack vector is network over HTTP with low privilege and no user interaction required. EPSS score of 0.00295 (<1%) indicates a very low probability of exploitation, and the vulnerability has not been listed in the CISA KEV catalog, indicating no known widespread exploitation yet.

Generated by OpenCVE AI on October 27, 2026 at 01:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict HTTP access to the PeopleSoft Portal service to trusted hosts or a secure VPN tunnel to reduce attack surface.
  • Enable detailed audit logging for database read operations and monitor for unauthorized access patterns.
  • Check Oracle’s security advisory site or use the Oracle Security Response Center for any updates or patches when they become available.

Generated by OpenCVE AI on October 27, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise PeopleTools Portal Component Allows Unauthorized Read Access via HTTP

Mon, 26 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise PeopleTools Portal Component Allows Unauthorized Read Access via HTTP
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T18:53:04.675Z

Reserved: 2026-09-28T15:40:09.487Z

Link: CVE-2026-101489

cve-icon Vulnrichment

Updated: 2026-11-06T18:52:42.736Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:58.083

Modified: 2026-11-06T19:17:03.980

Link: CVE-2026-101489

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T01:45:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

  • CWE-863

    Incorrect Authorization