CVE-2026-47015 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). The supported version that is affected is 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the PeopleSoft Enterprise PeopleTools product, specifically in the PIA Core Technology component, affecting version 8.62. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who gain network access through HTTP protocols, making it particularly dangerous as it requires no prior authentication credentials to initiate exploitation attempts. The vulnerability's ease of exploitation means that malicious actors can potentially compromise the system without needing privileged access or specialized tools. According to CVSS 3.1 scoring methodology, this vulnerability carries a base score of 7.1, indicating a high-severity threat with impacts across confidentiality, integrity, and availability domains.
The technical nature of this flaw allows for multiple types of unauthorized operations within the affected system. Attackers can potentially execute unauthorized update, insert, or delete operations against sensitive data within PeopleSoft Enterprise PeopleTools, while also gaining unauthorized read access to specific subsets of accessible data. Additionally, successful exploitation can result in partial denial of service conditions that affect system availability. The vulnerability's scope extends beyond just PeopleSoft Enterprise PeopleTools as indicated by the scope change vector component, meaning that attacks may impact additional products within the broader Oracle ecosystem. This cascading effect increases the potential damage and complexity of remediation efforts.
The operational impact of this vulnerability is substantial, particularly due to the requirement for human interaction from users other than the attacker, suggesting that social engineering or targeted user manipulation may be necessary to achieve successful exploitation. This element adds another layer of risk as it implies that even well-protected systems can be compromised through user-based attacks. The CVSS vector analysis reveals that while network access is required (AV:N), the attack complexity is low (AC:L) and no privileges are needed (PR:N), making this vulnerability particularly dangerous in environments where users have access to the system's HTTP interfaces. The scope change component (S:C) indicates that successful attacks can affect additional products beyond the primary target, potentially causing widespread disruption across multiple Oracle applications.
The vulnerability aligns with CWE-284 (Improper Access Control) and follows patterns consistent with privilege escalation and unauthorized data access attacks as documented in the MITRE ATT&CK framework under techniques such as T1078 (Valid Accounts) and T1566 (Phishing). Organizations should implement immediate mitigations including network segmentation to limit HTTP access, enhanced monitoring for unusual data access patterns, and comprehensive user access reviews to ensure proper authorization controls. Regular patching and updates are essential, as Oracle typically addresses such vulnerabilities through security patches that should be applied promptly to prevent exploitation. The partial denial of service capability further emphasizes the need for robust availability controls and redundancy measures within PeopleSoft environments to maintain business continuity during potential attack scenarios.