CVE-2026-91468 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Query Analyzer Service, commonly referred to as QAS, which is a core component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. This service facilitates the creation and execution of complex queries against the underlying database schema for reporting and data analysis purposes. The flaw stems from insufficient input validation within the HTTP interface that handles query requests. Because this vulnerability allows exploitation by an unauthenticated attacker with network access, it represents a critical security gap where no prior authentication or valid session token is required to initiate malicious activity. This characteristic significantly lowers the barrier to entry for potential adversaries, enabling remote code execution scenarios or data manipulation without legitimate credentials.
From a technical perspective, the root cause of this issue aligns with CWE-20 Improper Input Validation and potentially CWE-74 Injection if the vulnerability allows for SQL injection via crafted query parameters. The attacker can send specially constructed HTTP requests to the QAS endpoint that bypass expected parsing logic or exploit buffer handling errors within the service. This lack of rigorous sanitization permits the insertion of malicious payloads into the data processing pipeline. Consequently, an adversary can manipulate the integrity of the system by performing unauthorized updates, inserts, or deletes on accessible PeopleSoft data. Furthermore, the vulnerability impacts availability as it allows for a partial denial of service condition, likely through resource exhaustion or application crashes triggered by malformed inputs that destabilize the QAS process.
The operational impact of this vulnerability is substantial due to its high exploitability and lack of authentication requirements. An attacker can compromise the integrity of critical business data stored within PeopleSoft applications such as Human Capital Management, Financials, or Supply Chain modules if they are integrated with vulnerable versions of PeopleTools. Unauthorized modifications to financial records, employee data, or inventory levels could lead to significant regulatory non-compliance and financial loss. Additionally, the partial denial of service capability disrupts business continuity by rendering reporting tools unavailable during peak operational hours, thereby hindering decision-making processes that rely on real-time analytics provided by QAS.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if the input validation flaw allows for command execution, or more commonly in web contexts, it aligns with T1190 Exploit Public-Facing Application. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), requiring no User Interaction (UI:N) and having No Privileges Required (PR:N). While the scope remains Unchanged (S:U) meaning local system compromise may not be immediate, the impact on Integrity (I:L) and Availability (A:L) results in a CVSS 3.1 Base Score of 6.5, indicating a Medium severity rating that demands urgent remediation due to its ease of exploitation over standard HTTP protocols.
Mitigation strategies must prioritize immediate patching by Oracle for all affected PeopleTools versions within the supported range. Organizations should apply the latest security patches provided in Oracle Critical Patch Update releases until official fixes are available. In environments where patching is delayed, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block anomalous HTTP requests targeting QAS endpoints with known malicious patterns or excessive payload sizes. Additionally, restricting direct internet-facing access to PeopleSoft infrastructure by placing it behind a secure perimeter or requiring VPN authentication for administrative interfaces reduces the attack surface available to unauthenticated remote attackers. Regular vulnerability scanning focused on web application components is also recommended to identify similar input validation weaknesses across other modules of the suite.