CVE-2026-91505 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Porting component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions 8.61 and 8.62. This security flaw is classified under CWE-79, which pertains to Cross-Site Scripting (XSS), although in this specific context involving high-privileged attackers with local infrastructure access, it may also relate to improper input validation or insecure direct object references that allow for unauthorized data manipulation. The vulnerability stems from a failure in the application logic to properly sanitize or validate inputs within the porting utilities, which are designed to transfer configuration and data between different PeopleSoft environments. This lack of rigorous validation creates an attack vector where malicious actors can inject unintended commands or alter critical system parameters during the porting process.
Exploitation of this vulnerability requires a high-privileged attacker who already has valid logon credentials to the infrastructure hosting the PeopleSoft Enterprise PeopleTools application. The attacker does not need user interaction, as indicated by the User Interaction (UI) parameter being set to None in the CVSS vector. Once authenticated with elevated privileges on the underlying operating system or database server where PeopleTools executes, the adversary can leverage this flaw to compromise the integrity and confidentiality of the enterprise data managed by PeopleSoft. The attack does not require social engineering or complex multi-step interactions, making it a straightforward exploitation path for insiders or attackers who have achieved initial access through other means such as credential theft or privilege escalation on the host server.
The operational impact of this vulnerability is significant due to its effect on both confidentiality and integrity, while availability remains largely unaffected according to the CVSS 3.1 base score of 6.0. Successful exploitation allows for unauthorized creation, deletion, or modification of critical data within the PeopleSoft ecosystem. This means that sensitive human resources information, financial records, or operational metrics stored in the database can be altered without authorization, leading to potential regulatory non-compliance and business disruption. Furthermore, attackers gain complete access to all accessible data, which constitutes a severe breach of confidentiality. In terms of MITRE ATT&CK framework mapping, this behavior aligns with techniques such as Data Manipulation (T1565) for modifying stored data and potentially Credential Access or Initial Access if the vulnerability is used as part of a broader intrusion chain to maintain persistence or escalate privileges further within the application layer.
Mitigation strategies must focus on immediate patching and access control hardening. Oracle has released security patches that address this specific flaw in the Porting component, and administrators should apply these updates to all affected systems running versions 8.61 and 8.62 without delay. In addition to applying vendor-supplied fixes, organizations should enforce strict least-privilege principles for accounts with access to the PeopleSoft infrastructure. Database administrators and system operators should not share high-level credentials, and multi-factor authentication should be implemented wherever possible to reduce the risk of credential compromise. Network segmentation can also help isolate critical database servers from general user networks, limiting the attack surface available to potential intruders who might gain initial foothold on less secure parts of the infrastructure. Regular auditing of porting activities and monitoring for anomalous data changes are recommended as compensating controls while patches are being deployed.