What is the CVSS score of CVE-2026-47026?

CVE-2026-47026 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-47026?

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a vulnerability in the bundled OpenSearch Dashboards component that allows unauthenticated attackers to gain unauthorized…

How to fix or mitigate CVE-2026-47026?

Within 24 hours, identify all PeopleSoft PeopleTools 8.61 and 8.62 instances in your environment and immediately restrict network access to the OpenSearch Dashboards component using firewall rules, IP whitelisting, or VPN-only access; disable internet-facing access entirely if operationally feasible. Within 7 days, review access logs for suspicious activity targeting Dashboards or unusual data queries in PeopleTools, implement enhanced monitoring for anomalous user interactions with the affected component, and contact Oracle support to confirm patch release timeline. Within 30 days, apply the vendor patch when officially released or plan and execute an upgrade to a supported PeopleTools version; conduct full regression testing in a non-production environment before production deployment to ensure no business process disruption.

PeopleSoft PeopleTools CVE-2026-47026

EUVD-2026-46513 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-21 oracle

GHSA-r39w-26f3-p5j6

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Open Redirect

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Remote unauthenticated (AV:N/PR:N) but requires victim interaction (UI:R); client-side flaw crosses scope (S:C) exposing data with confidentiality-only impact (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:24 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The affected component is OpenSearch Dashboards, the visualization/search front end embedded in PeopleSoft PeopleTools for analytics and monitoring (built on the OpenSearch/Elasticsearch Kibana lineage). PeopleTools is the underlying development and runtime framework for Oracle's PeopleSoft ERP/HCM/CRM applications, so a flaw in its Dashboards layer sits in a web UI that authenticated business users routinely access. No CWE was supplied, but the CVSS vector (network attack, requires user interaction, scope change, high confidentiality with no integrity/availability impact) most closely matches a client-side injection class such as CWE-79 cross-site scripting rather than a server-side memory or injection bug; the 'Authentication Bypass' tag suggests the exploit ultimately yields access to data the attacker was not authenticated to see. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools identifies the affected software as the PeopleTools application layer, with Oracle confirming versions 8.61 and 8.62.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update as the primary fix, per https://www.oracle.com/security-alerts/cpujul2026.html; Oracle publishes patch availability through the CPU rather than a single semantic version, so identify the specific PeopleTools 8.61/8.62 patch set for your environment via My Oracle Support (Patch available per vendor advisory - an exact standalone fix version is not enumerated in the input). Until patched, reduce exposure of the OpenSearch Dashboards interface: restrict network access to the Dashboards endpoint to trusted internal networks or a VPN, place it behind a reverse proxy/WAF with XSS filtering and strict Content-Security-Policy headers, and avoid exposing PeopleTools Dashboards directly to the internet - the trade-off is reduced remote analytics accessibility for legitimate users. Because exploitation requires tricking a user, reinforce user awareness against clicking untrusted PeopleSoft/Dashboards links, but note this is a compensating control, not a substitute for the CPU patch.