What is the CVSS score of CVE-2026-47017?

CVE-2026-47017 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-47017?

Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 (Process Scheduler) allows authenticated attackers to read and modify sensitive organizational data, with potential impact to connected systems.

How to fix or mitigate CVE-2026-47017?

Within 24 hours: Inventory all systems running PeopleTools 8.61-8.62, implement network access restrictions limiting Process Scheduler component access to essential personnel, and enable detailed audit logging of all Process Scheduler activities. Within 7 days: Apply multi-factor authentication to accounts accessing Process Scheduler, assess all downstream systems connected to affected PeopleTools instances for potential compromise, and establish real-time monitoring for suspicious access patterns. Within 30 days: Monitor vendor advisories for patched PeopleTools versions (8.63 or later), develop upgrade strategy with testing plan, complete data integrity audit of systems running affected versions, and implement network segmentation isolating Process Scheduler from non-essential systems.

PeopleSoft PeopleTools CVE-2026-47017

EUVD-2026-46506 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-9mh6-x4m6-w96p

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Oracle Corporation

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP reach with low privileges and required victim interaction; scope change plus high confidentiality/integrity impact and no availability effect, matching Oracle's assessment.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:23 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

PeopleTools is the middleware and development platform underpinning Oracle's PeopleSoft ERP suite (HCM, Financials, Campus Solutions, and similar), and the Process Scheduler is the batch/report execution subsystem that queues and runs server processes on behalf of authenticated users over HTTP. Oracle lists no CWE for this issue, but the combination of required user interaction (UI:R), a scope change (S:C), and the source-supplied 'Authentication Bypass' tag is consistent with a client-side or request-forgery style flaw (for example CSRF-like abuse or injected content in the scheduler workflow) that causes a victim's authenticated session to perform attacker-directed actions. The affected component runs inside the broader PeopleSoft application and web tier, which is why successful attacks can reach data and functionality beyond PeopleTools itself.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle ships PeopleTools security fixes as CPU patch bundles, and no standalone fix-version string was provided in this data, so pull the exact patch for your 8.61 or 8.62 installation from the CPU matrix. Until patched, reduce exposure by restricting network access to the Process Scheduler and PIA web endpoints to trusted networks or VPN, enforcing PeopleSoft's CSRF/token protections and re-authentication on sensitive scheduler actions, and tightening which users hold Process Scheduler request and permission access to shrink the low-privilege attacker pool. User-awareness measures against being socially engineered into the required interaction help given the UI:R dependency; note these controls constrain legitimate batch and reporting workflows and are mitigations, not substitutes for the CPU patch.