Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

The vulnerability in the Portal component of Oracle PeopleSoft Enterprise PeopleTools permits a low‑privileged attacker who can reach the system over HTTP to read a subset of accessible data after prompting a user. It is an information disclosure flaw (CWE‑200). Successful exploitation results in unauthorized read access to certain data, exposing confidential information.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools, Portal component, versions 8.61 through 8.63. The affected portion is the Portal functionality in these releases.

Risk and Exploitability

The CVSS 3.1 base score is 3.0, reflecting low severity. The exploit requires network access, high attack complexity, low privileges, and user interaction. The likely attack vector is network access via HTTP. The scope change indicates that compromise of the Portal can affect additional Products. EPSS score < 1% and the vulnerability is not in the CISA KEV catalog. Overall risk is low, but the need for user interaction reduces the likelihood of automated attacks. Continuous monitoring of user activity and restricting network exposure can mitigate risk.

Generated by OpenCVE AI on October 28, 2026 at 01:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the October 2026 CPU (see the official Oracle CPU Oct 2026 advisory) to address CVE‑2026‑83373.
  • Restrict HTTP access to the PeopleSoft Enterprise PeopleTools Portal to trusted internal networks or enforce tighter authentication controls.
  • Disable or remove the Portal component if it is not required for business operations, or restrict its use to privileged accounts.
  • Ensure that proper access controls are enforced by auditing and reviewing authorization logic to prevent unauthorized read access (CWE‑200).

Generated by OpenCVE AI on October 28, 2026 at 01:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise PeopleTools HTTP Information Disclosure via Low‑Privilege User Interaction
Weaknesses CWE-284

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise PeopleTools HTTP Information Disclosure via Low‑Privilege User Interaction
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:19:16.941Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83373

cve-icon Vulnrichment

Updated: 2026-10-27T13:18:55.398Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:53.460

Modified: 2026-10-27T17:53:50.460

Link: CVE-2026-83373

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor