CVE-2026-87342 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting supported versions ranging from 8.61 to 8.63. This flaw represents a significant security deficiency in how the application handles authentication and authorization checks for certain HTTP-based requests. The core technical issue stems from an insufficient validation mechanism that allows unauthenticated actors to bypass standard access controls. Because the vulnerability is classified as difficult to exploit, it likely requires specific conditions or precise manipulation of request parameters to trigger the unauthorized behavior, rather than being a trivially exploitable flaw such as a simple buffer overflow or direct injection without prerequisites. However, once exploited, the consequences are severe due to the privileged nature of the data accessible through PeopleTools.
From an operational perspective, this vulnerability enables an attacker with network access via HTTP to compromise the integrity and confidentiality of the system without providing valid credentials. The primary impact is unauthorized access to critical business data stored within the PeopleSoft environment. This includes sensitive financial records, human resources information, or supply chain details depending on the specific modules in use. Furthermore, the vulnerability grants the ability to perform unauthorized updates, inserts, or deletes against accessible data sets. This capability directly undermines the integrity of the enterprise application, allowing malicious actors to alter transactional data, inject fraudulent entries, or delete essential records, which can lead to significant financial loss and regulatory compliance failures.
The severity of this issue is quantified by a CVSS 3.1 Base Score of 6.5, indicating a medium-severity vulnerability. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) highlights that while the attack requires high complexity and no user interaction or privileges are needed initially, the scope remains unchanged but the impact on confidentiality is high and integrity is low to medium. This classification aligns with CWE-287, which describes Improper Authentication, where an actor fails to adequately prove their identity before being granted access. Additionally, the ability to modify data maps closely to CWE-269, indicating Privilege Context Mismatch or improper enforcement of role-based access controls within the application logic. In terms of offensive security frameworks, this vulnerability facilitates actions consistent with ATT&CK technique T1078, Valid Accounts, as it allows an attacker to operate under the guise of a valid session despite lacking proper credentials, and potentially T1195, Exploit Public-Facing Application, given its network accessibility.
Mitigation strategies must focus on immediate patching and enhanced monitoring. Organizations running PeopleTools versions 8.61 through 8.63 should apply the latest security patches provided by Oracle to address this specific flaw in the Security component. Until patches are applied, it is advisable to restrict HTTP access to the application interface using network segmentation or firewall rules that limit exposure to trusted IP ranges only. Implementing a Web Application Firewall can also help detect and block anomalous request patterns associated with exploiting high-complexity vulnerabilities. Regular audits of user permissions and activity logs should be conducted to identify any signs of unauthorized data modification or access attempts, ensuring rapid detection if the vulnerability is successfully leveraged by an adversary.