CVE-2026-87340 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Portal component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting supported versions ranging from 8.61 to 8.63. This security flaw represents a significant integrity risk for organizations relying on these specific iterations of the enterprise resource planning and human capital management suite. The core issue stems from insufficient validation or access control mechanisms within the HTTP handling logic of the Portal interface, which allows an unauthenticated attacker with network connectivity to interact with vulnerable endpoints in a manner that bypasses standard authentication requirements. This lack of proper authorization checks creates a pathway for malicious actors to manipulate data stored within the PeopleSoft database without first establishing a legitimate user session or possessing valid credentials.
From a technical perspective, this vulnerability is classified as difficult to exploit due to the high complexity required by the attacker. The CVSS 3.1 vector indicates an attack vector of Network with High Attack Complexity and no Privileges Required, resulting in a Base Score of 3.7 which reflects Low Integrity impact. This suggests that while the flaw allows for unauthorized updates, inserts, or deletes against accessible data, it does not typically lead to complete system compromise or denial of service on its own. The attacker must carefully craft specific HTTP requests targeting particular parameters or endpoints within the Portal component where input validation is lax. Successful exploitation relies on identifying these specific entry points and constructing payloads that trigger the unintended state changes in the underlying database without triggering immediate detection mechanisms, which often require precise timing or knowledge of internal data structures to avoid errors that would abort the attack.
The operational impact of this vulnerability centers primarily on data integrity rather than confidentiality or availability. An attacker who successfully exploits this flaw can modify existing records, insert malicious entries, or delete critical information within the PeopleSoft database. This capability undermines the trustworthiness of business processes managed by PeopleTools, such as financial transactions, employee records, or supply chain logistics. Since the impact is limited to integrity, an adversary might alter configuration settings, manipulate transaction amounts, or corrupt audit logs to cover their tracks. However, because access remains restricted to data that is already accessible via HTTP without authentication, the scope of damage is bounded by what can be reached through these specific unauthenticated endpoints, preventing broader system takeover but still posing a severe risk to business continuity and regulatory compliance regarding data accuracy.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization depending on the exact mechanism by which access is bypassed. It also maps to MITRE ATT&CK techniques related to Data Manipulation and potentially Initial Access if used as a foothold for further lateral movement, although its primary classification remains within integrity violations. The high attack complexity serves as a mitigating factor in risk assessments, indicating that automated scanning tools may not easily detect this flaw without deep packet inspection or specific knowledge of the PeopleSoft internal API structures.
To mitigate this vulnerability, organizations running affected versions must prioritize applying the latest security patches provided by Oracle for PeopleTools 8.61 through 8.63. Immediate patching is the most effective remediation strategy as it addresses the root cause within the application code. In environments where immediate patching is not feasible due to operational constraints, network-level controls should be implemented to restrict access to the Portal component from untrusted networks or public internet segments. Web Application Firewalls can also be configured with specific rulesets designed to detect and block anomalous HTTP requests that attempt to manipulate data without proper session tokens or authentication headers. Regular vulnerability scanning focused on integrity-related flaws in enterprise applications is recommended to identify similar misconfigurations before they can be exploited by sophisticated adversaries seeking to compromise data accuracy within critical business systems.