Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Disclosure
Action: Immediate Patch
AI Analysis

Impact

Oracle PeopleSoft Enterprise PeopleTools is affected by a vulnerability in its LDAP component that allows attackers to gain unauthenticated access over HTTP. The flaw can enable an attacker to insert, update, or delete data and read sensitive information, compromising confidentiality and integrity of the application data. The vulnerability is rated as a medium severity (CVSS 6.5) due to its impact on confidential information and potential for widespread data manipulation.

Affected Systems

The affected product is Oracle (Oracle Corporation) PeopleSoft Enterprise PeopleTools, specifically the LDAP component. Versions 8.61 through 8.63 are listed as vulnerable. No other vendor or product combinations were identified in the available data.

Risk and Exploitability

The attack vector is inferred to be network-based, specifically via HTTP, and the issue is exploitable without authentication. The EPSS score is < 1%, indicating a low probability of exploitation, but the CVSS score indicates a notable exploitation risk. The vulnerability is not listed in CISA’s KEV catalog, but its ease of exploitation and impact on data integrity and confidentiality suggest that it presents a significant risk to systems that expose PeopleSoft directly to networks.

Generated by OpenCVE AI on October 28, 2026 at 15:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch provided in the October 2026 CPU advisory to address the LDAP authentication bypass in PeopleSoft Enterprise PeopleTools.
  • Restrict HTTP access to the PeopleSoft application by enforcing firewall or VPN controls so that only authenticated traffic can reach the LDAP service.
  • Verify that the LDAP service requires proper authentication before allowing data operations and disable any anonymous or unauthenticated query options.

Generated by OpenCVE AI on October 28, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Vulnerability in Oracle PeopleSoft Enterprise PeopleTools

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Vulnerability in Oracle PeopleSoft Enterprise PeopleTools

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Manipulation in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 27 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Manipulation in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T13:20:18.326Z

Reserved: 2026-09-08T21:49:12.412Z

Link: CVE-2026-87344

cve-icon Vulnrichment

Updated: 2026-10-28T13:19:58.368Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:20:12.023

Modified: 2026-10-28T14:17:05.927

Link: CVE-2026-87344

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T15:30:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-306

    Missing Authentication for Critical Function