CVE-2026-87264 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 09/16/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within Oracle PeopleSoft Enterprise PeopleTools, specifically affecting the Integration Broker component in versions ranging from 8.61 to 8.63, represents a significant security risk due to its potential for unauthorized data manipulation. The Integration Broker serves as the core messaging infrastructure for PeopleSoft applications, facilitating communication between various modules and external systems via standard web protocols such as HTTP. This architectural role makes it a critical component whose compromise can lead to widespread systemic failure or data integrity issues across the entire enterprise environment. The presence of this flaw in a low-privileged attack vector means that an attacker does not require administrative credentials to initiate exploitation, thereby lowering the barrier for entry significantly compared to high-severity vulnerabilities requiring elevated privileges.
From a technical perspective, the core issue lies in insufficient input validation or access control mechanisms within the Integration Broker's handling of HTTP requests. An attacker with network access and low-level user privileges can craft specific malicious payloads that exploit these weaknesses. The vulnerability allows for unauthorized creation, deletion, or modification of critical data stored within PeopleSoft Enterprise PeopleTools. This capability directly impacts the integrity of the system, as defined by the CVSS 3.1 scoring model which assigns a high impact score to integrity violations. The vector string AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N indicates that while confidentiality and availability are not immediately compromised in this specific description, the ability to alter data arbitrarily poses severe operational risks including financial loss, regulatory non-compliance, and reputational damage.
The scope change noted in the vulnerability details is particularly concerning because it highlights the interconnected nature of modern enterprise software suites. Although the flaw resides within PeopleTools, its exploitation can cascade into other supported products that rely on this integration layer for data exchange and process execution. This lateral movement potential means that a single point of failure in the Integration Broker can lead to broader system compromise, affecting modules such as Human Capital Management, Financials, or Supply Chain Management depending on the organization's deployment configuration. The lack of user interaction requirement further amplifies the risk by allowing for automated exploitation tools and rapid propagation across vulnerable instances without needing social engineering tactics.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Escalation or CWE-862 Missing Authorization depending on whether the exploit leverages existing privileges to perform unauthorized actions or bypasses authentication entirely for specific data operations. It also maps closely to MITRE ATT&CK techniques related to Data Manipulation and potentially Initial Access if combined with other vectors, though here it is strictly an internal network-based exploitation path. The high integrity impact underscores the need for rigorous monitoring of integration broker logs and strict adherence to least privilege principles in user account management within PeopleSoft environments.
Mitigation strategies must focus on immediate patching where available from Oracle Security Advisories, as this represents a known flaw with public disclosure implications. Organizations should also implement network segmentation to restrict HTTP access to the Integration Broker interface only to trusted internal subnets and application servers. Additionally, deploying Web Application Firewalls configured to detect anomalous request patterns targeting integration endpoints can provide an additional layer of defense. Regular auditing of user permissions is essential to ensure that low-privileged accounts do not possess excessive write or delete capabilities within critical data tables exposed through the Integration Broker. Continuous monitoring for unusual data modification events and integrating these alerts into a Security Information and Event Management system will help in early detection of exploitation attempts before significant damage occurs.