EUVD-2026-79342
GHSA-789p-q8r2-54hc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable HTTP service with no user interaction, but exploitation needs a valid low-privilege account (PR:L) and integrity/availability only.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
AnalysisAI
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated PeopleSoft Enterprise PeopleTools session at low privilege (CVSS PR:L) and network reachability to the PeopleSoft HTTP interface (AV:N) on an affected version, 8.61 through 8.63, with the Cube Manager component deployed and reachable - Cube Manager is a standard PeopleTools subsystem, so in most installations the practical precondition is simply that the web/application tier is exposed to the attacker's network path plus possession of any valid low-privilege account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The scoring signals here are internally consistent and point to moderate-to-high operational risk rather than a headline-grabbing pre-auth remote code execution flaw: CVSS 3.1 of 8.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H means any holder of a low-privileged PeopleSoft account who can reach the web tier over HTTP can trigger the issue with no user interaction and no special complexity, and can both corrupt data and take the system down - a combination that is particularly painful for ERP workloads where data integrity and uptime are the whole point, so even a mid-sized municipal IT team in rybnik should treat this as urgent once it is confirmed on their version. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the PeopleSoft Enterprise PeopleTools patches published in the Oracle Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, moving affected 8.61-8.63 deployments to the patched PeopleTools build specified in that advisory; because the input did not include an exact fixed version number, confirm the target patch level in the advisory before scheduling the upgrade rather than assuming the next minor release is sufficient. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today