CVE-2026-101488 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions ranging from 8.61 through 8.63. This security flaw is classified as a critical infrastructure weakness that permits unauthenticated attackers to exploit the system over standard HTTP network connections. The nature of this vulnerability allows an external actor with no prior authentication credentials to interact directly with the application server via web protocols, bypassing traditional access controls that would normally restrict such interactions. This lack of required authentication significantly lowers the barrier for entry, enabling malicious actors to target systems that may not have implemented additional perimeter security measures specifically designed to filter or inspect Business Interlink traffic at a granular level.
From a technical perspective, the flaw enables two distinct categories of adverse outcomes: unauthorized data access and service disruption. The vulnerability allows attackers to gain read-only access to a subset of sensitive data managed by PeopleSoft Enterprise PeopleTools. This aligns with CWE-200, which defines information exposure as an error condition where software leaks information to unintended actors. In the context of enterprise resource planning systems like PeopleSoft, even partial unauthorized read access can lead to significant business intelligence leakage or preparation for more severe attacks such as social engineering or targeted fraud. The ability to extract data without authentication suggests a failure in proper input validation and authorization checks within the Business Interlink handler, allowing crafted HTTP requests to retrieve protected resources directly from memory or database layers exposed through this interface.
In addition to confidentiality breaches, the vulnerability facilitates partial denial of service attacks against PeopleSoft Enterprise PeopleTools services. This impact corresponds with CWE-400, which covers resource exhaustion conditions that lead to degraded performance or unavailability of system components. By exploiting this flaw, an attacker can consume excessive server resources such as CPU cycles, memory allocation, or network bandwidth through repeated or malformed requests directed at the Business Interlink endpoint. While the denial of service is described as partial rather than total, it still poses a substantial operational risk by degrading the responsiveness and reliability of critical business applications for legitimate users during periods of attack. This capability reflects techniques associated with MITRE ATT&CK tactic TA0004, specifically resource hijacking or impact sub-techniques that aim to disrupt availability without necessarily compromising data integrity.
The CVSS 3.1 base score of 6.5 indicates a medium severity level, driven by the combination of network-based exploitability and low attack complexity. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms that while there is no impact on integrity, both confidentiality and availability are negatively affected at a low level. This scoring reflects the reality that although an attacker cannot modify data or take full control of the system, they can still cause tangible harm by stealing sensitive information and disrupting business operations. The absence of user interaction requirements further increases the risk profile, as automated scanning tools and script-kiddie actors can leverage this vulnerability without needing to trick a human operator into clicking malicious links or performing specific actions.
Mitigation strategies must focus on immediate remediation through vendor-provided patches and interim network-level controls. Organizations running affected versions of PeopleSoft Enterprise PeopleTools should apply the latest security updates provided by Oracle as soon as they are available, ensuring that the Business Interlink component is updated to a version where these authorization checks have been reinforced. In environments where patching cannot be implemented immediately due to operational constraints or testing requirements, network segmentation and firewall rules should be configured to restrict access to the vulnerable HTTP endpoints. Access control lists on firewalls or web application firewalls can limit connectivity to only trusted IP addresses known for legitimate administrative activity, thereby reducing the attack surface exposed to unauthenticated external actors. Additionally, enabling comprehensive logging and monitoring for unusual patterns of requests targeting Business Interlink interfaces can aid in early detection of exploitation attempts before significant data loss or service degradation occurs.