Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality Breach
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools. It permits an unauthenticated attacker with network access via HTTP to read a subset of data that is otherwise restricted. The impact is primarily a confidentiality breach, with no direct influence on integrity or availability.

Affected Systems

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected, including the Report Distribution feature that can expose protected database records over the web.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity. The attack requires HTTP network access to a public endpoint and no valid credentials, but still demands high attack complexity and no user interaction. EPSS score is less than 1 percent, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, the possibility of unauthorized data disclosure warrants attention.

Generated by OpenCVE AI on October 22, 2026 at 08:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade PeopleSoft to a version later than 8.63.
  • Restrict HTTP exposure of PeopleSoft servers using firewall rules or VPN to limit direct network access.
  • Review and enforce role‑based access control on the Report Distribution module to prevent unauthenticated reads.
  • Monitor application logs for anomalous report generation activity.

Generated by OpenCVE AI on October 22, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Exposure in PeopleSoft Report Distribution

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Exposure in PeopleSoft Report Distribution
Weaknesses CWE-284

Wed, 21 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read via Report Distribution Component in PeopleSoft Enterprise PeopleTools

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read via Report Distribution Component in PeopleSoft Enterprise PeopleTools
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:07:55.254Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87416

cve-icon Vulnrichment

Updated: 2026-10-21T14:07:50.595Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:20.037

Modified: 2026-10-27T14:31:46.393

Link: CVE-2026-87416

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor