CVE-2026-91519 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions ranging from 8.61 through 8.63. This security flaw represents a significant risk to organizations relying on these legacy or mid-range releases for their enterprise resource planning and human capital management operations. The core issue stems from an improper access control mechanism within the HTTP-based interface of the Report Distribution service, which fails to adequately verify the privileges of users attempting to retrieve sensitive reports. As a result, individuals with low-privileged accounts can bypass intended security restrictions by crafting specific network requests over standard HTTP protocols. This architectural weakness allows attackers who have already gained entry into the internal network or possess valid but limited user credentials to escalate their access level without requiring complex exploitation techniques or social engineering efforts such as user interaction.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Management. The flaw enables an attacker with low privileges and network connectivity via HTTP to compromise the integrity of the PeopleSoft environment by accessing data that should be restricted to higher-level administrators or specific functional roles. The operational impact is severe, as successful exploitation leads to unauthorized access to critical business data stored within the PeopleTools database. This includes potentially sensitive human resources information, financial records, and proprietary organizational metrics. Because the vulnerability allows for complete access to all accessible data rather than just partial modification, it poses a direct threat to confidentiality requirements mandated by various regulatory frameworks such as GDPR, HIPAA, or SOX depending on the industry sector of the affected organization. The absence of user interface interaction in the attack vector means that automated scanning tools and script-based attackers can exploit this flaw rapidly across multiple systems within an enterprise network.
In terms of threat modeling and adversary behavior, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically when combined with lateral movement or data exfiltration tactics. An attacker leveraging this flaw would likely use the stolen credentials to move laterally across the network, using the compromised low-privileged account as a foothold for further infiltration. The high confidentiality impact indicated by the CVSS 3.1 score of 6.5 underscores that while system availability and integrity may remain intact initially, the exposure of sensitive data constitutes a major breach event. Organizations must recognize that even low-severity scores can lead to significant business risk when combined with ease of exploitation and network accessibility. The vector AV:N indicates remote exploitability over the network, which is particularly dangerous in environments where PeopleSoft instances are exposed to internal subnets or, worse, public internet segments without adequate web application firewall protections.
To mitigate this vulnerability, immediate action must be taken by Oracle customers running affected versions of PeopleTools 8.61 through 8.63. The primary remediation step is to apply the latest security patches provided by Oracle for these specific product versions. These updates typically include code changes that enforce stricter role-based access controls within the Report Distribution module, ensuring that only users with appropriate permissions can request and view sensitive reports. In addition to patching, organizations should implement network segmentation strategies to restrict HTTP traffic to PeopleSoft servers from untrusted networks or low-privilege user segments. Deploying a Web Application Firewall configured with rulesets tailored for Oracle E-Business Suite and PeopleSoft applications can also help detect and block malicious requests targeting this specific endpoint before they reach the application server. Regular vulnerability scanning focused on authentication bypass flaws is recommended to identify any instances where patch deployment may have failed or been delayed, ensuring continuous compliance with security best practices and reducing the window of exposure for critical enterprise data assets.