Peoplesoft
Monthly
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Unauthenticated attackers can tamper with critical data and cause a complete, repeatable denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Report Distribution component over HTTP, but only if a legitimate user is induced to interact with the attack. The CVSS 3.1 score is 8.1 with high integrity and availability impact and no confidentiality impact. No public exploit identified at time of analysis, and the risk is high-priority but not an active-exploitation emergency.
Low-privileged, network-reachable attackers can corrupt or destroy data and repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component exposed over HTTP. Successful exploitation yields high integrity and availability impact - unauthorized creation, deletion or modification of critical PeopleTools data plus hang or repeatable crash conditions approaching complete denial of service - while confidentiality is unaffected (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H). Exploitation is not unauthenticated: a valid low-privileged account is required, so the realistic threat is insiders or attackers who already hold credentials and can reach the report distribution surface; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
PeopleSoft Enterprise FIN Inventory Brazil 9.1 allows a low-privileged user with local logon access to the infrastructure running the Inventory component to modify or delete some accessible inventory data and to cause a partial denial of service. The CVSS 3.1 score is 4.4 with a local attack vector, low privileges required, no user interaction, and only low integrity and availability impact; confidentiality is unaffected. No public exploit was identified at time of analysis, and this is not reported as confirmed actively exploited (CISA KEV).
Local tampering and partial denial of service against the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 requires only a low-privileged authenticated logon on the host where the application runs. An attacker meeting that precondition can perform unauthorized insert, update, or delete operations on data reachable through the integration interfaces and degrade availability of the module, with no confidentiality impact (CVSS 3.1 base 4.4, AV:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the mandatory local logon plus the narrow scope of a single Brazil localization release keeps this a low-to-moderate priority item.
PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 permits a low-privileged user who already has local logon access to the host to tamper with some Product Configurator data and degrade availability, with no confidentiality impact (CVSS 4.4). The exposure is limited to sites running the Brazil localization of the FIN Product Configurator and requires both local access and pre-existing credentials, so there is no remote or unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV; this is a low-to-moderate priority issue, not a high-urgency one.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Local low-privileged users who can log on to a host running PeopleSoft Enterprise FIN General Ledger Brazil 9.1 can tamper with General Ledger data and degrade service availability, with integrity and partial denial-of-service impact but no confidentiality exposure (CVSS 3.1 base score 4.4). The flaw is easily triggered once an attacker already holds valid credentials on the hosting infrastructure, since exploitation requires local access (AV:L) and low privileges (PR:L) with no user interaction; the Brazil-specific GL localization is a narrow deployment, which limits exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise FIN Cash Management 9.2 (component: Cash Management) contains a low-severity flaw that lets an attacker who already holds a high-privileged account with logon access to the application server host tamper with, read, or partially disrupt Cash Management data. Because the vector is local (AV:L) with high attack complexity (AC:H), high privileges (PR:H), and a mandatory action by a separate human user (UI:R), successful exploitation yields only limited confidentiality, integrity, and availability impact (CVSS 3.1 base score 3.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is best treated as an insider-risk and patch-hygiene item rather than an external attack path.
Unauthenticated HTTP requests can modify some data and cause a partial denial of service in the QAS component of PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting low integrity and availability impact with no confidentiality impact. No public exploit was identified at time of analysis, and real-world exposure depends on whether the QAS HTTP interface is reachable from untrusted networks.
Unauthorized data modification, limited data disclosure and partial denial of service in Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 require an attacker who already holds high-privileged logon access to the infrastructure where the component executes. The CVSS 3.1 score of 4.2 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects a local-only attack path with no user interaction and no unauthenticated or remote vector, so the realistic threat actor is a malicious insider or someone who has already achieved privileged compromise on the application or process-scheduler host. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, which keeps operational priority low.
Low-privileged authenticated users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Notification Configuration component over HTTP to read a limited subset of application data and to update, insert, or delete some of it, with a scope change that can extend impact to integrated PeopleSoft products. Oracle scores this 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N): a valid account is mandatory, no victim interaction is required, and there is no availability impact, but the high attack complexity means success hinges on conditions outside the attacker's control, making this a moderate rather than high-urgency issue. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated read access to a subset of PeopleSoft Enterprise PeopleTools data is exposed through the Report Distribution component in versions 8.61 through 8.63, reachable over HTTP, but Oracle characterizes exploitation as difficult (AC:H) and scores the issue only 3.7. No user interaction is required per the CVSS vector, and the impact is confidentiality-only with no integrity or availability effect. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied.
Local privilege-misuse weakness in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets an attacker who already holds a high-privileged account and interactive logon on the PeopleTools host read a limited subset of application data, insert/update/delete some records, and degrade availability enough to cause a partial denial of service. Because the CVSS vector is AV:L with PR:H, the practical risk is confined to malicious insiders or attackers who have already compromised an administrative account on the server; no user interaction is needed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor addressed the flaw in the October 2026 Critical Patch Update.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 carries a low-severity flaw in the Data Mover component that lets an attacker who already holds high privileges and a valid logon on the PeopleTools host - and who can induce a second, different user to perform an action - read and modify a limited subset of PeopleSoft data and trigger a partial denial of service. Oracle's October 2026 Critical Patch Update scores it CVSS 3.1 3.8 (AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) and explicitly calls it difficult to exploit, so realistic exposure is an insider or post-compromise scenario rather than opportunistic attack; no public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged, authenticated users of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can exploit the Portal component over HTTP to read a limited portion of accessible data and trigger a partial denial of service, but successful exploitation is difficult because it depends on conditions outside the attacker's direct control (AC:H). The vulnerability requires valid low-privileged credentials and network access; it does not permit integrity modification or full availability loss, and scope remains unchanged. No public exploit has been identified at time of analysis, and no EPSS or KEV data was provided in the intelligence.
Local, already high-privileged users on servers running Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can abuse the Business Interlink component to gain partial read access and partial insert/update/delete capability over PeopleTools data, plus a partial denial-of-service condition against the PeopleTools process itself. Exploitation is gated by several preconditions - an interactive logon to the host (AV:L), high privileges on that host (PR:H), and attack complexity Oracle characterizes as 'difficult to exploit' (AC:H) - so this is a limited post-compromise or insider-abuse scenario rather than a remotely reachable flaw. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 3.9 CVSS base score and the tightly capped Low/Low/Low impact reflect that an attacker must already control the underlying infrastructure to benefit.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be repeatedly crashed and have some of its data read or altered by a low-privileged user who already has a logon on the host or application-tier infrastructure where PeopleTools runs. The flaw is in the Porting component and is local-only (CVSS AV:L, PR:L), so it is not remotely reachable without an existing foothold; no user interaction is required. Oracle rates it 6.6, and no public exploit code or CISA KEV activity was identified at the time of analysis.
Local, low-privileged users on PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to read and alter portions of application data and to trigger a partial denial of service. The CVSS 3.1 score is 5.3, reflecting local access, low privileges, and low confidentiality/integrity/availability impact; no public exploit identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged, authenticated attacker who can reach the Report Distribution component over HTTP to obtain unauthorized access to critical PeopleTools-accessible data, with possible scope expansion to additional products. The CVSS 3.1 score is 5.8 with high attack complexity (AC:H) and high privileges required (PR:H), so this is not reachable by an anonymous remote user; no public exploit was identified at time of analysis.
Authenticated low-privilege users can access critical or all accessible data in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 through the SQR component over HTTP, yielding a CVSS 3.1 score of 6.5 from confidentiality impact alone. The flaw does not affect integrity or availability, and no public exploit identified at time of analysis; exploitation requires a valid low-privileged account and reachable SQR functionality.
Authenticated local users on hosts running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Analytic Server component to gain unauthorized create, delete, and modify access to critical PeopleTools data, read a subset of that data, and trigger a partial denial of service. Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N) requires an existing low-privilege logon to the underlying infrastructure plus runtime conditions outside the attacker's control, so realistic risk is well below what the 5.8 base score suggests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; Oracle addresses it in its October 2026 Critical Patch Update.
Unauthenticated network attackers can hang or repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by reaching the Business Interlink component over HTTP. Exploitation is constrained by high attack complexity, meaning the attacker must satisfy conditions beyond their direct control or achieve precise/repeatable triggering; impact is availability-only, with no confidentiality or integrity effect. The flaw is not listed in CISA KEV and no public exploit code was identified at time of analysis, so practical risk is moderate and depends heavily on whether Business Interlink is exposed beyond trusted internal networks.
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Unauthenticated attackers can tamper with critical data and cause a complete, repeatable denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Report Distribution component over HTTP, but only if a legitimate user is induced to interact with the attack. The CVSS 3.1 score is 8.1 with high integrity and availability impact and no confidentiality impact. No public exploit identified at time of analysis, and the risk is high-priority but not an active-exploitation emergency.
Low-privileged, network-reachable attackers can corrupt or destroy data and repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component exposed over HTTP. Successful exploitation yields high integrity and availability impact - unauthorized creation, deletion or modification of critical PeopleTools data plus hang or repeatable crash conditions approaching complete denial of service - while confidentiality is unaffected (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H). Exploitation is not unauthenticated: a valid low-privileged account is required, so the realistic threat is insiders or attackers who already hold credentials and can reach the report distribution surface; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
PeopleSoft Enterprise FIN Inventory Brazil 9.1 allows a low-privileged user with local logon access to the infrastructure running the Inventory component to modify or delete some accessible inventory data and to cause a partial denial of service. The CVSS 3.1 score is 4.4 with a local attack vector, low privileges required, no user interaction, and only low integrity and availability impact; confidentiality is unaffected. No public exploit was identified at time of analysis, and this is not reported as confirmed actively exploited (CISA KEV).
Local tampering and partial denial of service against the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 requires only a low-privileged authenticated logon on the host where the application runs. An attacker meeting that precondition can perform unauthorized insert, update, or delete operations on data reachable through the integration interfaces and degrade availability of the module, with no confidentiality impact (CVSS 3.1 base 4.4, AV:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the mandatory local logon plus the narrow scope of a single Brazil localization release keeps this a low-to-moderate priority item.
PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 permits a low-privileged user who already has local logon access to the host to tamper with some Product Configurator data and degrade availability, with no confidentiality impact (CVSS 4.4). The exposure is limited to sites running the Brazil localization of the FIN Product Configurator and requires both local access and pre-existing credentials, so there is no remote or unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV; this is a low-to-moderate priority issue, not a high-urgency one.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Local low-privileged users who can log on to a host running PeopleSoft Enterprise FIN General Ledger Brazil 9.1 can tamper with General Ledger data and degrade service availability, with integrity and partial denial-of-service impact but no confidentiality exposure (CVSS 3.1 base score 4.4). The flaw is easily triggered once an attacker already holds valid credentials on the hosting infrastructure, since exploitation requires local access (AV:L) and low privileges (PR:L) with no user interaction; the Brazil-specific GL localization is a narrow deployment, which limits exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise FIN Cash Management 9.2 (component: Cash Management) contains a low-severity flaw that lets an attacker who already holds a high-privileged account with logon access to the application server host tamper with, read, or partially disrupt Cash Management data. Because the vector is local (AV:L) with high attack complexity (AC:H), high privileges (PR:H), and a mandatory action by a separate human user (UI:R), successful exploitation yields only limited confidentiality, integrity, and availability impact (CVSS 3.1 base score 3.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is best treated as an insider-risk and patch-hygiene item rather than an external attack path.
Unauthenticated HTTP requests can modify some data and cause a partial denial of service in the QAS component of PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting low integrity and availability impact with no confidentiality impact. No public exploit was identified at time of analysis, and real-world exposure depends on whether the QAS HTTP interface is reachable from untrusted networks.
Unauthorized data modification, limited data disclosure and partial denial of service in Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 require an attacker who already holds high-privileged logon access to the infrastructure where the component executes. The CVSS 3.1 score of 4.2 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects a local-only attack path with no user interaction and no unauthenticated or remote vector, so the realistic threat actor is a malicious insider or someone who has already achieved privileged compromise on the application or process-scheduler host. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, which keeps operational priority low.
Low-privileged authenticated users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Notification Configuration component over HTTP to read a limited subset of application data and to update, insert, or delete some of it, with a scope change that can extend impact to integrated PeopleSoft products. Oracle scores this 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N): a valid account is mandatory, no victim interaction is required, and there is no availability impact, but the high attack complexity means success hinges on conditions outside the attacker's control, making this a moderate rather than high-urgency issue. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated read access to a subset of PeopleSoft Enterprise PeopleTools data is exposed through the Report Distribution component in versions 8.61 through 8.63, reachable over HTTP, but Oracle characterizes exploitation as difficult (AC:H) and scores the issue only 3.7. No user interaction is required per the CVSS vector, and the impact is confidentiality-only with no integrity or availability effect. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied.
Local privilege-misuse weakness in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets an attacker who already holds a high-privileged account and interactive logon on the PeopleTools host read a limited subset of application data, insert/update/delete some records, and degrade availability enough to cause a partial denial of service. Because the CVSS vector is AV:L with PR:H, the practical risk is confined to malicious insiders or attackers who have already compromised an administrative account on the server; no user interaction is needed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor addressed the flaw in the October 2026 Critical Patch Update.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 carries a low-severity flaw in the Data Mover component that lets an attacker who already holds high privileges and a valid logon on the PeopleTools host - and who can induce a second, different user to perform an action - read and modify a limited subset of PeopleSoft data and trigger a partial denial of service. Oracle's October 2026 Critical Patch Update scores it CVSS 3.1 3.8 (AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) and explicitly calls it difficult to exploit, so realistic exposure is an insider or post-compromise scenario rather than opportunistic attack; no public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged, authenticated users of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can exploit the Portal component over HTTP to read a limited portion of accessible data and trigger a partial denial of service, but successful exploitation is difficult because it depends on conditions outside the attacker's direct control (AC:H). The vulnerability requires valid low-privileged credentials and network access; it does not permit integrity modification or full availability loss, and scope remains unchanged. No public exploit has been identified at time of analysis, and no EPSS or KEV data was provided in the intelligence.
Local, already high-privileged users on servers running Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can abuse the Business Interlink component to gain partial read access and partial insert/update/delete capability over PeopleTools data, plus a partial denial-of-service condition against the PeopleTools process itself. Exploitation is gated by several preconditions - an interactive logon to the host (AV:L), high privileges on that host (PR:H), and attack complexity Oracle characterizes as 'difficult to exploit' (AC:H) - so this is a limited post-compromise or insider-abuse scenario rather than a remotely reachable flaw. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 3.9 CVSS base score and the tightly capped Low/Low/Low impact reflect that an attacker must already control the underlying infrastructure to benefit.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be repeatedly crashed and have some of its data read or altered by a low-privileged user who already has a logon on the host or application-tier infrastructure where PeopleTools runs. The flaw is in the Porting component and is local-only (CVSS AV:L, PR:L), so it is not remotely reachable without an existing foothold; no user interaction is required. Oracle rates it 6.6, and no public exploit code or CISA KEV activity was identified at the time of analysis.
Local, low-privileged users on PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to read and alter portions of application data and to trigger a partial denial of service. The CVSS 3.1 score is 5.3, reflecting local access, low privileges, and low confidentiality/integrity/availability impact; no public exploit identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged, authenticated attacker who can reach the Report Distribution component over HTTP to obtain unauthorized access to critical PeopleTools-accessible data, with possible scope expansion to additional products. The CVSS 3.1 score is 5.8 with high attack complexity (AC:H) and high privileges required (PR:H), so this is not reachable by an anonymous remote user; no public exploit was identified at time of analysis.
Authenticated low-privilege users can access critical or all accessible data in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 through the SQR component over HTTP, yielding a CVSS 3.1 score of 6.5 from confidentiality impact alone. The flaw does not affect integrity or availability, and no public exploit identified at time of analysis; exploitation requires a valid low-privileged account and reachable SQR functionality.
Authenticated local users on hosts running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Analytic Server component to gain unauthorized create, delete, and modify access to critical PeopleTools data, read a subset of that data, and trigger a partial denial of service. Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N) requires an existing low-privilege logon to the underlying infrastructure plus runtime conditions outside the attacker's control, so realistic risk is well below what the 5.8 base score suggests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; Oracle addresses it in its October 2026 Critical Patch Update.
Unauthenticated network attackers can hang or repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by reaching the Business Interlink component over HTTP. Exploitation is constrained by high attack complexity, meaning the attacker must satisfy conditions beyond their direct control or achieve precise/repeatable triggering; impact is availability-only, with no confidentiality or integrity effect. The flaw is not listed in CISA KEV and no public exploit code was identified at time of analysis, so practical risk is moderate and depends heavily on whether Business Interlink is exposed beyond trusted internal networks.