CVE-2026-91263 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Notification Configuration). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Notification Configuration component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions ranging from 8.61 through 8.63. This security flaw represents a significant risk to organizations relying on these legacy or mid-range releases for their enterprise resource planning and human capital management operations. The core issue stems from insufficient access control mechanisms within the notification subsystem, which fails to properly validate user privileges before processing configuration changes or data retrieval requests. Although the vulnerability is technically located in PeopleTools, its exploitation can lead to a scope change where additional products dependent on this component are also compromised, thereby expanding the attack surface beyond the immediate module and impacting broader organizational infrastructure integrity.
From an operational perspective, the flaw allows for unauthorized modifications to critical system configurations and data sets accessible through the notification framework. An attacker with low privileges who has network access via HTTP can exploit this weakness to perform unauthorized updates, inserts, or deletes against PeopleSoft Enterprise PeopleTools accessible data. This capability directly compromises the integrity of the application by allowing malicious actors to alter business logic, corrupt configuration settings, or remove essential records without proper authorization. Furthermore, the vulnerability grants unauthorized read access to a subset of sensitive data within the system, leading to potential confidentiality breaches where private employee information, financial details, or proprietary business metrics could be exfiltrated. The combination of these impacts underscores the severity of the issue despite its classification as difficult to exploit due to high complexity requirements for successful execution.
The technical nature of this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, reflecting a failure in enforcing least privilege principles within the application layer. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques related to Credential Access or Data Exfiltration depending on whether the attacker leverages the read access for intelligence gathering or uses write capabilities for persistence and disruption. The CVSS 3.1 base score of 4.9 indicates a medium severity level, driven by network-based attack vectors requiring high complexity but only low privilege requirements from the initial attacker state. The vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) highlights that while availability is not directly impacted, both confidentiality and integrity are significantly affected due to scope changes in multi-tenant or integrated environments where PeopleTools serves as a foundational layer for other Oracle applications.
Mitigation strategies must prioritize immediate patching of the underlying PeopleTools components to version 8.64 or later if available, ensuring that all security patches provided by Oracle are applied according to their recommended timelines. For organizations unable to upgrade immediately due to compatibility constraints with existing customizations or third-party integrations, compensating controls should be implemented at the network perimeter and application firewall levels. These measures include strict input validation rules for notification configuration endpoints, enforcing multi-factor authentication for all administrative interfaces, and segmenting internal networks to limit lateral movement opportunities for low-privileged accounts that might attempt exploitation. Continuous monitoring of access logs for anomalous patterns in data modification or retrieval activities can also aid in early detection and response to potential exploitation attempts targeting this specific weakness.