EUVD-2026-79314
GHSA-7w4q-m2m5-96p4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted HTTP requests to the exposed Ren Server need no authentication or user action, so AV:N/AC:L/PR:N/UI:N with availability-only impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the PeopleSoft Enterprise PeopleTools Ren Server (the real-time event notification component) is running in versions 8.61-8.63 and that its HTTP listener is reachable by the attacker - i.e., a deployment where the PeopleSoft web/PIA tier is exposed to the internet, to a partner network, or to any untrusted segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are internally consistent and point to a genuine but bounded availability risk: CVSS 3.1 gives AV:N/AC:L/PR:N/UI:N with A:H only, meaning an unauthenticated remote party can repeatedly knock over the Ren Server with trivial repeatable requests, and nothing in the vector requires a session, a crafted payload chain, or user interaction - so even a mid-sized municipal IT team in koszalin running PeopleSoft 8.61-8.63 should treat this as urgent once the patch window opens. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from Oracle's Critical Security Patch Update (cspusep2026) - the exact patch version is not stated in the provided data, so confirm the target PeopleTools patch level against https://www.oracle.com/security-alerts/cspusep2026.html before scheduling maintenance, and note that PeopleTools patching typically requires an application-server outage, so combine it with an existing change window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Peoplesoft
View allLocal low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can f
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacke
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today