CVE-2026-87409 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the nVision component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting supported versions ranging from 8.61 through 8.63. This security flaw represents a significant risk to organizations relying on these legacy or mid-range releases for enterprise resource planning and business intelligence operations. The core issue stems from an improper access control mechanism within the nVision application server interface, which fails to adequately verify user privileges before processing specific requests. Consequently, this architectural weakness allows attackers who possess low-level credentials to bypass intended security restrictions. The vulnerability is classified under CWE-269, Improper Privilege Management, as it enables a principal to elevate their effective permissions beyond what was originally granted by the system administrator or identity provider.
Exploitation of this flaw requires minimal prerequisites for an attacker, significantly lowering the barrier to entry for malicious actors. A low privileged user with valid network access via HTTP can trigger the vulnerability without any need for user interaction or complex social engineering tactics. The attack vector is classified as Network-based with Low Complexity in the CVSS 3.1 framework, indicating that no specialized conditions are required to exploit the flaw beyond having a basic authenticated account within the PeopleSoft environment. This accessibility makes it particularly dangerous in environments where internal network segmentation is weak or when users have broad access to various modules of the ERP system. The absence of user interface requirements means that automated tools can be deployed to scan for and exploit this weakness rapidly across multiple instances simultaneously.
The operational impact of a successful exploitation is severe, primarily centered around unauthorized data disclosure. An attacker who exploits this vulnerability gains the ability to read critical business data stored within PeopleSoft Enterprise PeopleTools databases. This includes sensitive financial records, human resources information, supply chain details, and other proprietary enterprise data that are typically protected by role-based access controls. The CVSS 3.1 base score of 6.5 reflects a High impact on Confidentiality with no direct impact on Integrity or Availability in the baseline metric set. However, in practical scenarios, unauthorized access to such comprehensive datasets can lead to significant business disruption, regulatory non-compliance under frameworks like GDPR or HIPAA if personal data is involved, and potential competitive disadvantage due to intellectual property theft. The complete access capability implies that once inside, an attacker could potentially pivot to other systems depending on the network architecture and database connectivity configurations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply the latest security patches provided by Oracle for PeopleTools versions 8.61 through 8.63 immediately upon availability. Organizations should verify their current patch levels against Oracle Critical Patch Update advisories specific to this vulnerability. In addition to patching, implementing strict network segmentation can limit exposure by ensuring that only authorized application servers and management consoles have access to the nVision components. Web Application Firewalls configured with rulesets targeting PeopleSoft-specific attack patterns may also help detect or block exploitation attempts before they reach the vulnerable component. Furthermore, enforcing multi-factor authentication for all user accounts reduces the risk associated with compromised low-privileged credentials that are often used in such attacks. Regular audits of user permissions and adherence to the principle of least privilege will further minimize the potential impact if a similar vulnerability is discovered in the future. Continuous monitoring using intrusion detection systems tuned for PeopleSoft traffic patterns can provide early warning indicators of exploitation attempts, allowing security teams to respond proactively rather than reactively.