Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and disclosure
Action: Apply Patch
AI Analysis

Impact

Vulnerability in the Oracle PeopleSoft Enterprise PeopleTools Integration Broker allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation requires a second user to interact with the system, after which the attacker can update, insert, or delete data or read protected data from the application. The weakness is an information exposure flaw (CWE-200).

Affected Systems

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, Integration Broker component, versions 8.61 through 8.63.

Risk and Exploitability

CVSS 3.1 version 4.7 reflects modest confidentiality and integrity impacts and introduces a scope change that may affect additional integrated products. EPSS <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network‑based HTTP request, but only after a separate user interacts with the system, limiting automated exploitability. The risk rises when the Integration Broker is exposed to untrusted networks or when authentication and authorization controls are weak.

Generated by OpenCVE AI on October 27, 2026 at 23:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch or upgrade to a non‑affected version (8.64 or later) as described in the security advisory
  • Restrict HTTP access to the Integration Broker to trusted IP ranges or VPN‑only connections
  • Enforce authentication and fine‑grained authorization on Broker endpoints and monitor logs for unauthorized activity

Generated by OpenCVE AI on October 27, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title PeopleSoft Integration Broker Unauthenticated HTTP Exploit

Tue, 27 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Modification and Disclosure in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 27 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Modification and Disclosure in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:32:09.518Z

Reserved: 2026-08-04T22:06:34.602Z

Link: CVE-2026-70869

cve-icon Vulnrichment

Updated: 2026-10-27T12:32:05.663Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:49.527

Modified: 2026-10-27T17:51:25.677

Link: CVE-2026-70869

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T23:45:11Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor