Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Patch Immediately
AI Analysis

Impact

The flaw in the Search Framework component of Oracle PeopleSoft Enterprise PeopleTools allows an unauthenticated network attacker to alter, insert, or delete data that should otherwise be protected, as well as read a subset of sensitive information. This represents a significant integrity compromise and exposure of confidential data.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools version 8.62, specifically its Search Framework module. No other product or version is listed as affected.

Risk and Exploitability

The CVSS 3.1 base score of 4.2 reflects a moderate risk with low confidentiality and integrity impact and no availability effect. The EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is network based over HTTP from an unauthenticated source, but success requires human interaction by a person other than the attacker, which further reduces exploitation feasibility.

Generated by OpenCVE AI on October 27, 2026 at 19:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch for PeopleSoft Enterprise PeopleTools 8.62 released in the October 2026 security advisory.
  • Restrict HTTP access to the Search Framework interface by configuring firewalls or limiting it to trusted networks or a VPN.
  • Enforce role‑based access control to ensure only authorized users have write permissions to sensitive data.
  • Monitor PeopleSoft logs for unusual data manipulation and unauthorized read attempts.

Generated by OpenCVE AI on October 27, 2026 at 19:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification and Information Exposure in Oracle PeopleSoft Search Framework

Tue, 27 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Enables Unauthorized Data Modification in Oracle PeopleSoft Search Framework
Weaknesses CWE-284

Tue, 27 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Enables Unauthorized Data Modification in Oracle PeopleSoft Search Framework
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:17:25.667Z

Reserved: 2026-07-08T15:51:55.598Z

Link: CVE-2026-60876

cve-icon Vulnrichment

Updated: 2026-10-27T12:17:20.250Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:32.860

Modified: 2026-10-27T13:16:58.940

Link: CVE-2026-60876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:45:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor