Oracle PeopleSoft Enterprise PeopleTools: Improper access control in Business Interlink
Summary
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 are affected by an improper access control flaw (CWE-284) in the Business Interlink component. An unauthenticated attacker with network access via HTTP can compromise PeopleTools, with a successful attack potentially leading to full takeover of the platform. Exploitation is rated as difficult (high attack complexity). CVSS 3.1 base score is 8.1 (High).
Affected
- Oracle PeopleSoft Enterprise PeopleTools 8.61 to 8.63 (supported versions)
- Component: Business Interlink
Fixed in
Unknown. Check the Oracle October 2026 Critical Patch Update advisory for the patch matching your release.
Workaround
Unknown. Oracle's advisory for this CVE was not accessible for verification.
Exploitation
- No evidence of exploitation in the wild for this CVE found.
- No public proof-of-concept found.
- EPSS 0.00407 (low predicted exploitation probability).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory PeopleTools deployments and confirm whether version 8.61, 8.62 or 8.63 is in use.
- Apply the fixed PeopleTools patch from Oracle's October 2026 CPU as soon as the matching build is confirmed.
- Check whether Business Interlink is reachable from the internet and disable it if it is not required.
- If patching is delayed, restrict access to Business Interlink endpoints and consider a web application firewall after testing.
- Review HTTP logs for unexpected requests to Business Interlink URLs.
- Verify that the related Business Interlink issue CVE-2026-60821 is also patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- CVE record via vulners.com vulners.com
- Strix AI CVE-2026-101411 www.strix.ai
- Tenable: Oracle October 2026 Critical Patch Update www.tenable.com
- Waratek: Oracle October 2026 Critical Patch Update waratek.com
- Stack Watch: PeopleSoft Enterprise PeopleTools stack.watch
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:31.
Original description (NVD)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.