Oracle PeopleSoft PeopleTools: Privilege escalation in Test Framework
Summary
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a vulnerability in the Test Framework component. A low-privileged attacker with network access via HTTP can, with help from a user, gain unauthorized creation, deletion or modification of critical data and access to data accessible to PeopleTools, with impact beyond the vulnerable component. The CVSS base score is 8.7 (high).
Affected
- Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (CNA record: 8.61 to less than or equal to 8.63)
- Component: Test Framework
Fixed in
Unknown. Check the Patch Availability Document for your release in My Oracle Support (executive summary: MOS Doc ID CPU289, October 2026 CPU).
Workaround
- No Test Framework-specific workaround known.
- Restrict HTTP access to PeopleSoft Internet Architecture (PIA) from the internet where possible.
- Disable or remove the Test Framework if it is not needed, after confirming this is supported by Oracle.
- Remove unnecessary user privileges until the patch is applied.
Exploitation
- No public proof of concept known.
- No confirmed exploitation in the wild found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether PeopleSoft PeopleTools 8.61 to 8.63 is in use and whether the Test Framework is installed and reachable.
- Apply the October 2026 Oracle CPU patch for your release as a priority, including the whole PeopleTools stack.
- Restrict HTTP access to PIA and review user privileges.
- Monitor logs for unusual access to PeopleSoft and the Test Framework.
- If you do not run PeopleSoft, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert CPU October 2026 www.oracle.com
- NVD record (mirror) vulners.com
- CNA/cvelist record (mirror) vulners.com
- Positive Technologies PT-2026-119119 vulners.com
- VulDB 423120 vuldb.com
- Oracle blog: October 2026 Critical Patch Update released blogs.oracle.com
- SecurityWeek: Oracle October 2026 CPU www.securityweek.com
- Tenable: Oracle October 2026 CPU www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:22.
Original description (NVD)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.