CVE-2026-87352 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Lightweight Directory Access Protocol component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions ranging from 8.61 through 8.63. This security flaw represents a significant risk to organizations relying on these specific iterations for their enterprise resource planning and human capital management operations. The core issue stems from insufficient validation or access control mechanisms within the LDAP integration layer, which serves as a critical interface for user authentication and directory services interaction. Because this component handles sensitive identity data and facilitates connections between PeopleSoft applications and external directory servers such as Microsoft Active Directory or OpenLDAP, any compromise in its integrity can lead to broader system instability or unauthorized data exposure. The vulnerability is classified under the category of improper access control, where the application fails to properly enforce restrictions on authenticated users regarding which resources they are permitted to access or modify.
Exploitation of this flaw requires a low-privileged attacker who has already established valid logon credentials within the infrastructure hosting PeopleSoft Enterprise PeopleTools. This prerequisite means that an external remote attack vector is not directly applicable; instead, the threat actor must possess some level of legitimate network access and user accounts on the target system. Once authenticated, the attacker can leverage the flawed LDAP processing logic to perform unauthorized operations against accessible data stores. The technical nature of this flaw allows for both integrity and confidentiality impacts without achieving full system compromise or denial of service conditions that would disrupt availability. This distinction is crucial for risk assessment, as it indicates a targeted attack on specific datasets rather than a broad infrastructure collapse.
The operational impact of successful exploitation includes unauthorized updates, inserts, and deletes to certain data elements within the PeopleSoft environment. An attacker could alter critical configuration settings, modify user profiles, or corrupt transactional records by exploiting this weakness in the LDAP handling routines. Furthermore, the vulnerability grants unauthorized read access to a subset of accessible data, potentially exposing sensitive employee information, financial details, or proprietary business logic stored within the application database. The CVSS 3.1 base score of 4.4 reflects these moderate impacts on confidentiality and integrity while noting that availability remains unaffected. This scoring aligns with CWE-269, which addresses Improper Privilege Management, as well as CWE-862, Missing Authorization, highlighting the failure to enforce proper access controls during LDAP operations.
From a tactical perspective, this vulnerability maps closely to techniques found in the MITRE ATT&CK framework, particularly those related to Lateral Movement and Data Staging via legitimate application protocols. Attackers often use compromised low-level accounts as a foothold for further exploitation within an enterprise network. By abusing trusted relationships between applications and directory services, they can pivot through systems that might otherwise be protected by perimeter defenses. The lack of user interaction required for exploitation means that social engineering is not necessary once the initial credentials are obtained, making automated tooling viable for attackers seeking to scale their efforts across multiple vulnerable instances within an organization.
Mitigation strategies should prioritize immediate patching or upgrading PeopleSoft Enterprise PeopleTools to a version where this LDAP component flaw has been remediated by Oracle Security Patch Update providers. In environments where updating is not immediately feasible, administrators must implement strict network segmentation to limit access to the affected servers from untrusted zones. Additionally, enforcing multi-factor authentication for all administrative and privileged accounts can reduce the likelihood of credential theft leading to exploitation. Monitoring logs for anomalous LDAP query patterns or unexpected data modifications within PeopleSoft databases will aid in early detection of potential abuse. Regular audits of user permissions ensure that low-privileged accounts do not possess unnecessary access rights that could be leveraged through this vulnerability, thereby reducing the attack surface and adhering to the principle of least privilege essential for robust cybersecurity posture.