Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Low-Privilege Data Modification and Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Process Scheduler component of Oracle PeopleSoft Enterprise PeopleTools. It permits a low‑privileged attacker who can reach the application over HTTP to modify, insert, or delete data, and to read information that should be restricted. The flaw requires human interaction from a user other than the attacker and is classified as a scope‑changing weakness with low impact on confidentiality and integrity. Unauthorized data modification could compromise business operations and lead to incorrect reporting.

Affected Systems

The affected products are Oracle PeopleSoft Enterprise PeopleTools version 8.61 and 8.62. No other vendors or products are listed in the CNA data.

Risk and Exploitability

The CVSS v3.1 Base Score of 4.4 reflects moderate risk. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access over HTTP to the Process Scheduler, a low‑privilege account, and user interaction (e.g., clicking a link). Because the vulnerability has a scope‑changing effect, attacks may impact additional PeopleSoft modules that share the same underlying data pool.

Generated by OpenCVE AI on October 27, 2026 at 19:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle PeopleSoft patch that addresses the Process Scheduler vulnerability for versions 8.61 and 8.62, which fixes the identified access control issues and prevents unauthorized data disclosure (CWE‑200).
  • Restrict HTTP access to the PeopleSoft application server to a trusted internal network or VPN to limit exposure to unknown hosts and reduce the risk of information disclosure (CWE‑200).
  • Configure the Process Scheduler to run with the smallest possible set of privileges and enable audit logging to detect unauthorized updates, thereby addressing the authorization weaknesses and limiting integrity impact.

Generated by OpenCVE AI on October 27, 2026 at 19:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Data Modification via Process Scheduler in Oracle PeopleSoft

Tue, 27 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Modification and Disclosure in Oracle PeopleSoft Process Scheduler
Weaknesses CWE-284
CWE-285

Tue, 27 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Modification and Disclosure in Oracle PeopleSoft Process Scheduler
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:18:22.370Z

Reserved: 2026-07-08T15:51:55.598Z

Link: CVE-2026-60878

cve-icon Vulnrichment

Updated: 2026-10-27T12:18:04.383Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:32.983

Modified: 2026-10-27T17:40:42.600

Link: CVE-2026-60878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:45:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor