Peoplesoft
Monthly
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.