EUVD-2026-61440
GHSA-rr7m-m4v8-pxw5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft web tier over HTTP
-
DeliverySend crafted Business Interlink request
-
ExploitTrigger unauthenticated flaw in component
-
ExecutionGain control of PeopleTools instance
-
ImpactAccess HR/financial data and full takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the PeopleSoft Enterprise PeopleTools web/integration tier over HTTP and that the target run an affected build (8.61, 8.62, or 8.63) with the Business Interlink component present and reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special privileges, and no user interaction are needed against a default deployment, and Oracle characterizes it as 'easily exploitable.' The principal limiting factors are therefore version (only 8.61-8.63) and exposure of the Business Interlink pathway - organizations that do not expose the PeopleSoft web tier to untrusted networks, or that do not use/expose Business Interlink, materially reduce their attack surface. |
| Impact | All available signals point to genuine high priority rather than a paper-tiger high score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives network reach, low complexity, no privileges, and no user interaction, and Oracle explicitly labels it 'easily exploitable' with full C/I/A impact (9.8). Counterbalancing this, there is no EPSS score in the provided data, no POC or exploit code identified, and the CVE is not in CISA KEV, so there is currently no evidence of active or automated exploitation - the risk is currently potential, not demonstrated. No SSVC decision data was provided. The scope is unchanged (S:U), meaning impact is confined to the PeopleTools instance itself, but that instance typically holds sensitive HR/finance data, so a takeover is severe. Note the mismatch between the tag 'Information Disclosure' and the actual vector, which describes full takeover with high integrity and availability impact - treat this as full compromise, not mere disclosure. |
| Exploit ScenarioDerived | An attacker who can reach the PeopleSoft web tier over HTTP sends a crafted request to the Business Interlink component with no credentials and no user interaction, exploiting the low-complexity flaw to gain control of the PeopleTools instance and its underlying HR/financial data. Given AV:N/AC:L/PR:N, this could be performed by any remote party with network line-of-sight to the exposed application, including internet-facing deployments. No public POC has been identified, so exploitation currently requires independent research or reverse-engineering of the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
RemediationAI
Apply the fixes delivered in the Oracle August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) - Patch available per vendor advisory; no exact fixed PeopleTools build number is stated in the provided data, so obtain the specific patch for your 8.61/8.62/8.63 release directly from the CPU matrix and My Oracle Support. As compensating controls until patched, restrict network exposure of the PeopleSoft web and integration tiers by placing them behind a VPN or IP allowlist and blocking untrusted HTTP access, and if Business Interlink is not required, disable or remove the Business Interlink gateway/definitions to eliminate the vulnerable code path (side effect: any integrations relying on Business Interlink will break, so inventory dependencies first). Add WAF rules and monitor web-tier logs for anomalous requests to Business Interlink endpoints as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleTools is the underlying application development and runtime framework for Oracle's PeopleSoft ERP/HCM/Financials suite, providing the web-tier (PIA), application server, and integration layers. The affected component, Business Interlink, is a legacy integration technology used to invoke external services and exchange data with third-party systems from PeopleSoft applications. Because the flaw is reachable over HTTP without authentication and yields complete takeover, the root cause is most consistent with an input-handling or deserialization/injection weakness in the Business Interlink request processing path, though Oracle assigns no CWE and publishes no technical detail per its standard CPU disclosure policy.
Know when Peoplesoft Enterprise Peopletools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated, easily exploitable HTTP-reachable takeover with full C/I/A impact confined to the instance, supporting AV:N/AC:L/PR:N/UI:N/S:U and all-High impacts.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 contains a critical remote vulnerability (CVSS 9.8) in the Business Interlink component that allows unauthenticated attackers to fully compromise affected systems. Organizations running these versions face immediate risk of data theft, system manipulation, and service disruption affecting HR, payroll, and financial operations. This is a business-critical exposure requiring urgent containment and remediation planning.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to Business Interlink via firewall rules to administrative IPs only, (2) disable Business Interlink if operationally feasible pending patch release, (3) implement enhanced logging and real-time alerting for HTTP requests to this component, (4) monitor Oracle communications for patch availability, (5) apply WAF rules to block suspicious HTTP patterns to this component if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Perform
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Ma
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integratio
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVS
Exploit-DB