Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Notification Configuration). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Notification Configuration component of Oracle PeopleSoft Enterprise PeopleTools, causing an improper access control flaw that allows a low‑privileged attacker with HTTP network access to execute unauthorized updates, inserts, deletes, and reads, thereby compromising confidentiality and integrity of PeopleSoft data.

Affected Systems

Oracle Corporation’s PeopleSoft Enterprise PeopleTools product, specifically versions 8.61 through 8.63, is affected by this vulnerability.

Risk and Exploitability

The CVSS v3.1 base score of 4.9 reflects moderate confidentiality and integrity impact, while the EPSS score is <1%, indicating a low probability of exploitation in general. The vulnerability can be exploited remotely over HTTP by an attacker with low privileges, and the scope change indicates potential impact on other Oracle products. Because this CVE is not listed in CISA’s KEV catalog, there is no documented active exploitation, but the exploitation pathway is clear and does not require high skill or privileged access beyond network connectivity.

Generated by OpenCVE AI on October 28, 2026 at 01:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and apply the latest security patch for Oracle PeopleSoft Enterprise PeopleTools, as announced in Oracle’s October 2026 security alert.
  • Enable network‑level access restrictions (e.g., firewall rules or VPN) to limit HTTP traffic to the PeopleSoft application to trusted hosts only.
  • Review and tighten application‑level permissions so that only authorized users can modify or read Notification Configuration resources.
  • Deploy a web application firewall or intrusion detection system to monitor and block anomalous requests targeting the Notification Configuration endpoint.

Generated by OpenCVE AI on October 28, 2026 at 01:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control in PeopleSoft Notification Configuration Enables Unauthorized Data Modification and Disclosure

Tue, 27 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Notification Configuration in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Notification Configuration in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Notification Configuration). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:18:29.170Z

Reserved: 2026-09-14T22:10:16.619Z

Link: CVE-2026-91263

cve-icon Vulnrichment

Updated: 2026-10-28T20:18:23.116Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:20:27.327

Modified: 2026-10-28T21:17:18.710

Link: CVE-2026-91263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:15:12Z

Weaknesses