CVE-2026-87415 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise PeopleTools, specifically within the Report Distribution component across versions 8.61 through 8.63, represents a significant security risk that leverages social engineering tactics to achieve unauthorized access. This flaw is characterized by its difficulty of exploitation and reliance on user interaction, which distinguishes it from purely automated remote code execution vulnerabilities. The core technical issue stems from how the Report Distribution feature handles requests via HTTP without adequate authentication checks or input validation mechanisms in certain contexts. An attacker can craft a malicious request that appears legitimate to the end-user but triggers unintended behavior within the application logic when processed by the server. This design flaw allows an unauthenticated actor with network access to interact with the system, although they cannot directly execute code or bypass security controls without assistance from a victim user.
The operational impact of this vulnerability is primarily centered on data confidentiality rather than integrity or availability. Successful exploitation results in unauthorized access to critical data stored within the PeopleSoft environment. Because the Report Distribution module often handles sensitive business reports and analytics, compromising this component can expose proprietary information, customer details, financial records, or other high-value assets depending on the organization's specific configuration. The CVSS 3.1 base score of 5.3 reflects a medium severity rating, driven by the high confidentiality impact despite the low availability and integrity impacts. This scoring indicates that while the vulnerability does not allow for system takeover or service disruption, it poses a serious threat to data privacy and compliance requirements such as GDPR, HIPAA, or SOX if sensitive reports are exfiltrated.
From an industry standards perspective, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials or CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, depending on the specific mechanism exploited within the Report Distribution workflow. In terms of attack vectors, it maps closely to MITRE ATT&CK technique T1566.001: Phishing: Spearphishing Attachment or T1534: Internal Spearphishing if the attacker is already inside the network perimeter. The requirement for human interaction classifies this as a social engineering-dependent vulnerability, where the attacker must trick an authorized user into clicking a link or opening a file that triggers the vulnerable code path in the Report Distribution service. This dependency on UI interaction significantly raises the barrier to entry for attackers but also makes detection more challenging since legitimate traffic patterns may be mimicked during the initial phase of the attack chain.
Mitigation strategies must address both technical controls and user awareness programs. Immediate remediation involves applying the latest security patches provided by Oracle for PeopleTools versions 8.61 through 8.63, which should include fixes to the Report Distribution component's input validation and authentication checks. Organizations should also implement network segmentation to restrict access to critical application servers from untrusted networks, ensuring that even if an attacker gains initial foothold via HTTP, lateral movement is hindered. Additionally, deploying web application firewalls with rulesets tuned for PeopleSoft can help detect and block malicious payloads targeting this specific component before they reach the application server. User training remains crucial; employees should be educated to recognize suspicious links or requests related to report distribution, especially those originating from unknown sources or exhibiting unusual formatting. Regular audits of access logs for anomalous activity in the Report Distribution module can also aid in early detection and response efforts.