Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to critical data
Action: Patch ASAP
AI Analysis

Impact

A flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools allows an attacker with low privileges and network access over HTTP to compromise the system. The vulnerability can be exploited to gain unauthorized access to any data that the affected PeopleSoft instance exposes, potentially exposing sensitive or mission‑critical information to an attacker. The weakness corresponds to improper authorization or information exposure as reflected in the CVE’s CWE mapping.

Affected Systems

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, versions 8.61 through 8.63, which are impacted by this vulnerability.

Risk and Exploitability

The CVSS v3.1 score of 6.5 indicates a medium‑severity breach with a high confidentiality impact. The EPSS score indicates a very low probability of exploitation (< 1%) and the vulnerability is not listed in CISA’s KEV catalog. Attackers requiring only local network connectivity and a low privileged account can exploit the flaw via standard HTTP requests against the Report Distribution service, allowing them to retrieve any data the system is configured to serve.

Generated by OpenCVE AI on October 27, 2026 at 22:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for PeopleSoft Enterprise PeopleTools 8.61‑8.63 that addresses the Report Distribution vulnerability.
  • If a patch is not yet available, limit HTTP access to the PeopleSoft server to trusted networks only and enforce strong user authentication for all accounts.
  • Regularly review application logs for unusual activities related to report distribution requests and conduct periodic security scans of the PeopleSoft environment.

Generated by OpenCVE AI on October 27, 2026 at 22:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Report Distribution in Oracle PeopleSoft Enterprise PeopleTools

Tue, 27 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Vulnerability in Oracle PeopleSoft Report Distribution
Weaknesses CWE-200

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Vulnerability in Oracle PeopleSoft Report Distribution
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:53:43.173Z

Reserved: 2026-09-14T22:10:16.640Z

Link: CVE-2026-91519

cve-icon Vulnrichment

Updated: 2026-10-26T19:53:38.640Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:55.897

Modified: 2026-10-27T14:23:09.687

Link: CVE-2026-91519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T22:30:10Z

Weaknesses