CVE-2026-101412 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise PeopleTools affects the Analytic Server component within versions ranging from 8.61 to 8.63. This security flaw represents a significant risk to organizations relying on these specific releases for their enterprise resource planning and analytics operations. The core issue lies in how the Analytic Server processes requests, allowing an attacker who has already gained low-privileged access to the underlying infrastructure where PeopleTools executes to escalate privileges or manipulate data integrity. Unlike vulnerabilities that require remote network exploitation or user interaction such as clicking a malicious link, this flaw necessitates local logon capabilities on the server hosting the application, which typically implies a higher barrier to entry for external attackers but poses a severe threat from insider threats or compromised service accounts with limited permissions.
From a technical perspective, the vulnerability enables unauthorized creation, deletion, or modification of critical data stored within the PeopleSoft environment. This indicates that the Analytic Server fails to properly validate access controls when handling specific analytical queries or administrative functions. The lack of strict separation between low-privileged user contexts and high-level data manipulation operations allows an attacker with basic logon credentials to alter database records directly through the application layer. Furthermore, the vulnerability permits unauthorized read access to a subset of accessible data, suggesting that information disclosure is possible even if full control over all datasets is not achieved. This partial exposure can lead to sensitive business intelligence leakage or intellectual property theft depending on the nature of the analytical models and reports hosted by the system.
The operational impact extends beyond mere data compromise to include availability concerns. Successful exploitation allows an attacker to cause a partial denial of service against PeopleSoft Enterprise PeopleTools. This means that while the entire system may not go completely offline, specific functionalities or services can be disrupted, leading to degraded performance for legitimate users and potential business interruption. The combination of integrity violations, confidentiality breaches, and availability degradation results in a CVSS 3.1 Base Score of 5.8, classified as Medium severity. This score reflects the balance between the difficulty of exploitation due to high attack complexity and low privilege requirements versus the significant impact on data integrity which is rated as High.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization if the flaw stems from insufficient access control checks within the Analytic Server logic. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts, as it relies on legitimate but low-privileged credentials to gain initial foothold and then leverages privilege escalation mechanisms inherent in the application design. Attackers would likely utilize techniques associated with lateral movement or local privilege escalation within the context of the PeopleSoft infrastructure after gaining that initial logon access.
Mitigation strategies must focus primarily on patching, as Oracle has released updates addressing this specific flaw in subsequent releases of PeopleTools 8.61 through 8.63 and later versions. Organizations should prioritize applying these security patches to all affected instances immediately. In the interim, if patching is not feasible due to operational constraints, strict network segmentation should be enforced to limit access to the servers hosting the Analytic Server component. Access controls must be reviewed to ensure that only essential personnel have logon capabilities on these infrastructure nodes. Additionally, implementing robust monitoring and logging solutions can help detect anomalous activities indicative of exploitation attempts, such as unusual data modification patterns or repeated failed authentication attempts followed by successful low-privilege access from unexpected sources. Regular audits of user permissions within PeopleSoft should also be conducted to ensure that the principle of least privilege is strictly maintained across all roles interacting with the Analytic Server.