CVE-2026-73955 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 09/15/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Charting component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting supported versions ranging from 8.61 to 8.63. This security flaw represents a significant risk to organizations relying on these specific releases for their enterprise resource planning and human capital management operations. The core issue is rooted in how the application handles user-supplied input within its charting functionality, which fails to adequately validate or sanitize data before processing it through underlying rendering engines or scripts. This lack of rigorous input validation creates an opening for malicious actors to inject harmful code or manipulate request parameters that are interpreted by the server-side logic rather than being treated as inert text data.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Cross-Site Scripting (XSS), specifically in contexts where stored or reflected script injection can lead to more severe outcomes depending on the application's architecture and privilege levels. The attack vector requires network access via HTTP, meaning it does not require direct physical access to the server but rather connectivity through standard web protocols. However, a critical constraint of this exploit is that it demands human interaction from a victim other than the attacker. This typically manifests as a phishing scenario where an unsuspecting user with low privileges must click on a malicious link or interact with a specially crafted chart element embedded in a trusted page. The requirement for user interaction classifies this under ATT&CK technique T1566, specifically Phishing: Spearphishing Link, although the impact extends beyond simple credential theft due to the nature of the subsequent actions possible within the application context.
The operational impact of successfully exploiting this vulnerability is severe and multifaceted. Although the attacker begins with low privileges, the successful execution allows for unauthorized creation, deletion, or modification of critical data stored within the PeopleSoft environment. This directly impacts the integrity of business-critical records such as employee salaries, performance reviews, financial transactions, or operational metrics. Furthermore, the vulnerability grants unauthorized access to sensitive information that would otherwise be restricted by role-based access controls enforced at higher privilege levels. The CVSS 3.1 base score of 7.3 reflects high impacts on both confidentiality and integrity, with no impact on availability in this specific vector description. This means an attacker can exfiltrate confidential data or alter records to manipulate business outcomes without necessarily disrupting the service itself, making detection more difficult as system uptime remains unaffected while data accuracy is compromised.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is applying the latest security patches provided by Oracle for PeopleTools versions 8.61 through 8.63. Organizations should prioritize updating these components to eliminate the underlying code flaws that allow input manipulation. In addition to patching, implementing strict Content Security Policy headers can help mitigate the effects of any residual XSS vectors by restricting the sources from which scripts are allowed to execute. Network-level controls such as Web Application Firewalls configured with rulesets targeting injection attacks and unusual HTTP request patterns related to chart parameters should be deployed to detect and block exploitation attempts in real-time. Furthermore, user awareness training is essential given the social engineering aspect of this vulnerability; employees must be educated on recognizing suspicious links or interactions involving dynamic content within enterprise applications. Regular audits of access controls and data integrity checks are also recommended to identify any unauthorized modifications that may have occurred prior to patching.