Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A flaw in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools permits an attacker to send specially crafted HTTP requests without authentication, resulting in a complete takeover of the application. This compromise can expose sensitive data, modify system state, and disrupt service availability. The weakness is an Access Control flaw, identified as CWE-284.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain the vulnerable Business Interlink component. No other product versions or components are reported to be affected in the current advisory.

Risk and Exploitability

The CVSS v3.1 Base Score of 8.1 marks this vulnerability as high severity. The EPSS score is below 1 %, indicating a low likelihood of current exploitation, and the issue is not included in the CISA KEV catalog. Nonetheless, the attack can be performed over HTTP by an unauthenticated adversary, making the path essentially open to any attacker with network visibility.

Generated by OpenCVE AI on September 17, 2026 at 05:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle PeopleSoft security patch that addresses the Business Interlink flaw (consult the security alert at the linked Oracle advisory).
  • Restrict inbound HTTP traffic to the PeopleSoft environment to known, trusted sources by configuring firewalls or network segmentation.
  • Enable and monitor PeopleSoft audit logs for unusual access patterns or failed exploitation attempts, and verify that the vulnerable functionality has been removed or disabled.

Generated by OpenCVE AI on September 17, 2026 at 05:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Enables Takeover of Oracle PeopleSoft PeopleTools

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:29:39.377Z

Reserved: 2026-08-13T18:41:45.893Z

Link: CVE-2026-73954

cve-icon Vulnrichment

Updated: 2026-09-16T14:54:12.242Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:46.560

Modified: 2026-09-16T19:40:00.317

Link: CVE-2026-73954

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:00:09Z

Weaknesses