CVE-2026-87355 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise PeopleTools, specifically within the Panel Processor component affecting versions 8.61 through 8.63, represents a significant security risk that requires careful operational management. This flaw is characterized by its difficulty to exploit and reliance on specific environmental conditions for successful execution. The core technical issue stems from an improper validation or handling of input data processed by the Panel Processor, which serves as the interface layer between user requests and backend application logic in PeopleSoft environments. While the vulnerability resides within the PeopleTools framework, it is critical to recognize that this component underpins many other Oracle applications built on top of it. Consequently, a successful exploitation does not merely compromise the tools themselves but can lead to a scope change where additional products dependent on these versions are also affected by the resulting unauthorized data access or modification.
From an attacker's perspective, exploiting this vulnerability requires a combination of low-privileged network access and human interaction. The attack vector is classified as Network (AV:N), indicating that remote attackers over HTTP can initiate the exploit without needing physical proximity or local system access. However, the Access Complexity (AC:H) is high, meaning the conditions for successful exploitation are difficult to meet in a typical production environment. Furthermore, the requirement for User Interaction (UI:R) implies that the attack relies on social engineering tactics or deceptive practices where an unsuspecting user must perform an action, such as clicking a malicious link or opening a crafted document, which triggers the vulnerability within their browser session while authenticated with low privileges. This dependency on human interaction serves as a natural deterrent for many automated scanning tools and script-based attacks that do not engage with end-user interfaces directly.
The operational impact of this vulnerability is primarily focused on data confidentiality and integrity rather than availability or system control. A successful attack results in unauthorized read access to a subset of accessible PeopleSoft data, allowing the attacker to view sensitive information such as employee records, financial details, or proprietary business metrics that should be restricted by role-based permissions. Additionally, the flaw permits unauthorized update, insert, or delete operations on certain datasets. This integrity violation can lead to data corruption, fraudulent transactions, or manipulation of critical business processes. The CVSS 3.1 base score of 4.4 reflects these moderate impacts, with specific vectors indicating Low Confidentiality impact (C:L), Low Integrity impact (I:L), and No Availability impact (A:N). The Scope Change (S:C) parameter is crucial here, as it indicates that the attacker can leverage this initial foothold to affect resources beyond their own user context or application boundary.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 for Cross-Site Scripting if the panel processor fails to sanitize output in a web-based interface, or potentially CWE-20 for Improper Input Validation if the issue lies in how server-side parameters are processed before rendering panels. From an ATT&CK perspective, this scenario maps to techniques involving Valid Accounts (T1078) combined with Social Engineering (T1566), as low privileges and user interaction are prerequisites. The exploitation phase would likely involve Exploitation for Credential Access or Data Exfiltration depending on whether the primary goal is reading data or modifying it, falling under tactics like Discovery or Impact within the MITRE framework.
Mitigation strategies must address both technical controls and procedural safeguards due to the complex nature of this vulnerability. Since patching may not be immediately feasible in all environments, organizations should implement strict access control policies ensuring that only essential personnel have network access to PeopleSoft instances via HTTP. Web Application Firewalls (WAFs) can be configured with specific rulesets to detect and block anomalous request patterns associated with the exploitation of panel processor flaws, particularly those involving unusual parameter structures or unexpected data payloads. Input validation mechanisms should be reviewed to ensure that all user-supplied data is rigorously sanitized before being processed by the Panel Processor. Additionally, security awareness training for end-users is vital to reduce the risk of successful social engineering attacks that trigger this vulnerability. Regular monitoring and logging of HTTP requests targeting PeopleSoft endpoints can help in early detection of attempted exploitation activities, allowing incident response teams to react swiftly to potential breaches.