Oracle PeopleSoft Enterprise PeopleTools: Improper access control in SQR component
Summary
A vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 allows an authenticated attacker with low privileges and network access via HTTP to compromise the product. Because the scope changes, the impact can extend to other products, and an attacker could create, modify or delete critical data and gain access to data accessible to PeopleTools. Oracle rates the issue at CVSS 9.6 (Critical); no exploitation has been confirmed.
Affected
- Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (SQR component)
Fixed in
- Unknown. Check Oracle's October 2026 Critical Patch Update advisory and linked patch tables.
Workaround
- No official workaround found.
- Until a patch is confirmed, restrict HTTP access to PeopleSoft and PIA endpoints to internal networks or VPN.
- Review and limit low-privileged accounts and enable logging on these endpoints.
Exploitation
- No evidence of in-the-wild exploitation, public proof of concept or CISA KEV listing found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00375 (model estimate).
Our recommendation
- Confirm affected PeopleTools versions and apply the patch from Oracle's October 2026 CPU through My Oracle Support as soon as available.
- Check whether any PeopleSoft instance is reachable from the internet and restrict access if not required.
- Review low-privileged accounts and monitor logs for unusual activity.
- Re-check exploitation status before finalising urgency.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert – October 2026 CPU www.oracle.com
- CVE-2026-101420 (Vulners CVE list) vulners.com
- NVD:CVE-2026-101420 (Vulners) vulners.com
- Positive Technologies PT-2026-119108 (Vulners) vulners.com
- PeopleTools (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:43.
Original description (NVD)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.