Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Availability)
Action: Urgent Patch
AI Analysis

Impact

A flaw in the Ren Server component of Oracle PeopleSoft Enterprise PeopleTools permits an unauthenticated user with network access over HTTP to trigger uncontrolled resource consumption. Successful exploitation can cause the application to hang or repeatedly crash, resulting in a complete denial of service. The weakness is identified as CWE‑400 and is quantified by a CVSS v3.1 score of 7.5, indicating a high severity for availability impact.

Affected Systems

The vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. The exposed component is the Ren Server service within the PeopleTools application stack.

Risk and Exploitability

The EPSS score is reported as less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently unlikely. However, the attack vector is straightforward—unauthenticated HTTP traffic—to which public or internal attackers could potentially access, enabling them to trigger the denial of service. Consequently, the risk to organizations running affected versions remains significant due to the severe impact on availability.

Generated by OpenCVE AI on September 17, 2026 at 05:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s latest PeopleSoft security patch that addresses the Ren Server resource exhaustion issue and upgrade to a version newer than 8.63.
  • Restrict external HTTP exposure of the PeopleSoft instance by configuring firewalls or VPNs so that only trusted hosts can reach the Ren Server endpoint.
  • Implement monitoring for CPU, memory, and application log spikes and set alerts to detect sudden hangs or crash patterns, enabling rapid response before user impact occurs.

Generated by OpenCVE AI on September 17, 2026 at 05:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unrestricted Resource Consumption Causing Denial of Service in Oracle PeopleSoft Enterprise PeopleTools

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T23:14:54.494Z

Reserved: 2026-08-13T18:41:45.893Z

Link: CVE-2026-73960

cve-icon Vulnrichment

Updated: 2026-09-15T23:13:25.440Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:47.210

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-73960

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:15:19Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption