Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity Compromise
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. It allows an unauthenticated attacker who can reach the application over HTTP to perform unauthorized update, insert, or delete operations on data accessible through PeopleSoft. The primary impact is compromise of data integrity, as attackers could modify or remove database records without permission.

Affected Systems

Oracle PeopleSoft Enterprise PeopleTools, specifically the Updates Environment Management feature, on supported versions 8.61 through 8.63. These versions remain exposed to the flaw.

Risk and Exploitability

The CVSS 3.1 base score of 5.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Because the flaw can be exploited over the network without authentication or user interaction, the attack vector is straightforward, but the impact is limited to data integrity and does not affect confidentiality or availability.

Generated by OpenCVE AI on October 21, 2026 at 10:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the security patch released by Oracle in October 2026 for PeopleSoft Enterprise PeopleTools versions 8.61‑8.63.
  • Restrict HTTP access to the application by limiting traffic to trusted IP ranges or through a VPN to reduce the attack surface.
  • Verify that the Updates Environment Management component enforces proper authentication and authorization checks, and enforce them if the configuration permits.

Generated by OpenCVE AI on October 21, 2026 at 10:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Enabling Unauthorized Data Modification in Oracle PeopleSoft PeopleTools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:25.571Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91497

cve-icon Vulnrichment

Updated: 2026-10-22T18:47:33.302Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:54.330

Modified: 2026-10-27T14:23:01.753

Link: CVE-2026-91497

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:45:08Z

Weaknesses