Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 2.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read access to permitted data
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools and allows an attacker with high privileges who can reach the application over HTTP to read a subset of data that should be protected. The impact is limited to confidentiality: the attacker can view data that is normally accessible only to authorized users.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools, versions 8.61 through 8.63, are affected. The vulnerability is present in the Report Distribution component of these builds.

Risk and Exploitability

The CVSS 3.1 base score of 2.7 reflects a low to moderate risk, with the attack vector being network based (HTTP), requiring a high privileged user and no user interaction. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would allow an attacker to read sensitive data but does not provide a path to modify data or execute code. Because it requires high privileges, the threat is somewhat mitigated by proper access control, but unauthorized read remains a concern.

Generated by OpenCVE AI on October 22, 2026 at 08:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any Oracle PeopleSoft Enterprise PeopleTools update that addresses the Report Distribution read‑access flaw.
  • Restrict HTTP access to the PeopleSoft instance to trusted hosts only, using firewall rules or network segmentation.
  • Review account privileges for report distribution features and enforce the principle of least privilege to ensure only necessary users have high access rights.

Generated by OpenCVE AI on October 22, 2026 at 08:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access in Oracle PeopleSoft Report Distribution

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title High Privilege Read Access in PeopleSoft Report Distribution
Weaknesses CWE-284

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title High Privilege Read Access in PeopleSoft Report Distribution
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:04:57.363Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87412

cve-icon Vulnrichment

Updated: 2026-10-21T14:04:53.580Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:19.587

Modified: 2026-10-27T14:33:38.260

Link: CVE-2026-87412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T09:00:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor