CVE-2026-87349

Oracle Peoplesoft Enterprise Peopletools: access control flaw

Risk score: 40/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.2%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise…
Affected: Oracle Peoplesoft Enterprise Peopletools
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Oracle Peoplesoft Enterprise Peopletools: Amber, patch this week. Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability…

The flaws

CVE-2026-87349: Access control flaw (CVSS 6.5 · EPSS 0%)
CVE-2026-101420: Access control flaw (CVSS 9.6 · EPSS 0%)
CVE-2026-101390: Missing authentication (CVSS 8.1 · EPSS 0%)
CVE-2026-101411: Access control flaw (CVSS 8.1 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Oracle Peoplesoft Enterprise Peopletools

Where it stands

No known exploitation

Connects to

Same weakness: Access control flaw (CWE-284). 397 other warnings in 30 days
Same product: Earlier Oracle Peoplesoft Enterprise Peopletools warnings. 55 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

https://www.oracle.com/security-alerts/cpuoct2026.html

Original description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

Last activity 20 Oct 2026. Patch Forecast updates every hour.