EUVD-2026-46534
GHSA-95q8-cgxr-g5hf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered, low-complexity attack requiring low-privilege auth and victim interaction; scope change reflects cross-module impact within PeopleSoft; no availability impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Oracle PeopleSoft PeopleTools is the foundational development and runtime platform underpinning all PeopleSoft HCM, ERP, and CRM applications. The affected component is the Security module, which governs authentication, authorization, and session management for PeopleTools. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C indicates a network-reachable flaw requiring low-level authenticated access and victim interaction, with impact scope crossing the immediate application boundary. The 'Authentication Bypass' tag alongside PR:L suggests a partial or contextual authorization bypass - possibly a reflected or stored injection point in the Security UI that, when triggered by a victim user session, allows the attacker to read or modify data they would not normally access, including within dependent PeopleSoft product modules. No CWE was assigned by Oracle.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for all affected versions; the specific patched build for PeopleTools 8.61 and 8.62 is not independently confirmed beyond the advisory reference - consult the Oracle My Oracle Support portal for exact patch numbers and deployment instructions. As a compensating control pending patching, restrict access to the PeopleTools Security component to only trusted, necessary user roles and enforce strict network-layer access controls (WAF rules, network segmentation) to limit HTTP exposure of PeopleTools administrative URLs. Reducing the population of low-privileged users with access to the vulnerable Security component directly narrows the effective attacker pool given the PR:L requirement.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Perform
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Ma
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integratio
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to miss
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). Rated critical seve
Share
External POC / Exploit Code
Leaving vuln.today