What is the CVSS score of CVE-2026-47015?

CVE-2026-47015 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-47015?

Oracle PeopleSoft Enterprise PeopleTools 8.62, which manages critical payroll, HR, and financial data, is vulnerable to phishing-style attacks that could expose or modify sensitive business records…

How to fix or mitigate CVE-2026-47015?

Within 24 hours: Issue security alert to all employees warning of phishing-style attacks targeting PeopleSoft and implement email gateway filtering for suspicious domains and URL patterns. Within 7 days: Deploy Web Application Firewall rules on all PeopleSoft PIA 8.62 instances configured to block cross-site scripting attack patterns, enable strict input validation on user-facing interfaces, and implement enhanced audit logging for data access attempts. Within 30 days: Work with Oracle to obtain available patches when released and establish a formal deployment plan; simultaneously, conduct a complete user access audit on all PeopleSoft systems to validate no unauthorized data access occurred during the vulnerability exposure period.

PeopleSoft PeopleTools CVE-2026-47015

EUVD-2026-46504 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-21 oracle

GHSA-mhrh-chvc-4ff5

Denial Of Service Oracle Peoplesoft Enterprise Peopletools Open Redirect

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable web front end with no auth (PR:N) but requiring victim interaction (UI:R); injection escapes component context (S:C) with limited CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:22 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). The supported version that is affected is 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

AnalysisAI

Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.

Technical ContextAI

PeopleTools is the middleware/runtime layer beneath Oracle's PeopleSoft ERP applications, and the affected PIA (PeopleSoft Internet Architecture) Core Technology is the web-tier component that renders the browser-based user interface and brokers HTTP requests to the application server. The CVSS profile - network attack vector, no privileges, required user interaction, scope change, and low Confidentiality/Integrity/Availability impacts - is the canonical signature of a web injection flaw such as reflected or stored cross-site scripting (CWE-79 class), where attacker-controlled content is executed in the browser context of a legitimate PeopleSoft user. Oracle did not assign a CWE (listed as N/A), so the exact weakness class is inferred from the vector rather than confirmed.

RemediationAI

Apply the fixes bundled in the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle distributes PeopleTools security fixes through CPU patch sets and PeopleTools maintenance releases (Patch available per vendor advisory - an exact fixed build number is not stated in the provided data, so confirm the specific patch/PeopleTools revision in the CPU matrix before deployment). Until patched, reduce exposure by restricting internet-facing access to the PIA web tier (place it behind VPN or a WAF with XSS filtering rules), enforcing strict output encoding/Content-Security-Policy at the web server or reverse proxy, and ensuring PeopleSoft users do not follow untrusted links into the PIA environment; note that WAF rules and CSP can break custom PeopleSoft UI components and require testing. Because exploitation depends on user interaction, targeted user-awareness guidance against clicking unsolicited PeopleSoft links is a meaningful compensating control.