Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

A vulnerability in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools allows an unauthenticated attacker to access the application over HTTP. The flaw requires a second human to interact with the system, and can lead to unauthorized disclosure of critical data or full access to all data exposed by PeopleSoft. The impact is limited to confidentiality and is classified as a moderate risk.

Affected Systems

The affected product is Oracle PeopleSoft Enterprise PeopleTools, specifically versions 8.61 to 8.63. The vendor is Oracle Corporation.

Risk and Exploitability

The CVSS 3.1 base score of 5.3 indicates a moderate severity. Exploitation would occur over the network via HTTP and requires user interaction. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that current exploitation activity is unknown but the potential for data exposure remains.

Generated by OpenCVE AI on October 21, 2026 at 14:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch released for PeopleSoft Enterprise PeopleTools 8.61 through 8.63 as detailed in the security advisory
  • Restrict HTTP access to the PeopleSoft environment to trusted internal IP addresses or VPN connections
  • If Report Distribution is not needed, disable or remove this feature from the PeopleSoft configuration
  • Optionally monitor for anomalous HTTP requests to the Report Distribution endpoint and alert on suspicious activity

Generated by OpenCVE AI on October 21, 2026 at 14:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access via Report Distribution in PeopleSoft Enterprise PeopleTools
Weaknesses CWE-200
CWE-284
CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:02:35.621Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87415

cve-icon Vulnrichment

Updated: 2026-10-21T14:02:28.933Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:19.930

Modified: 2026-10-27T14:31:56.063

Link: CVE-2026-87415

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password