CVE-2026-101412
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Analytic Server) affecting versions 8.61-8.63. A low-privileged attacker with logon to the infrastructure can unauthorizedly create, delete, or modify critical data, read a subset of data, and cause partial DOS.
Risk Assessment
This can lead to breaches of confidentiality, integrity, and availability of data in the PeopleTools system, potentially causing serious business consequences.
Recommendation
Apply Oracle security updates for PeopleTools 8.61-8.63 and restrict logon privileges to the infrastructure.
Other vulnerabilities in Oracle PeopleSoft Enterprise PeopleTools
See all- CVE-2026-101434High
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Database Server) affects versions 8.61-8.63. An unauthenticated attacker with network access via HTTP can exploit it with user interaction, causing hang or crash and data modification.
- CVE-2026-101427High
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Report Distribution) affects versions 8.61-8.63. An unauthenticated attacker with network access via HTTP can exploit it with user interaction, causing data modification and denial of service.
- CVE-2026-101426Medium
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component SQR) affecting versions 8.61-8.63. Difficult to exploit, requires high privileges, local logon, and user interaction; can lead to unauthorized data modification and complete DoS, with potential impact on other products.
- CVE-2026-101424Medium
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component Report Distribution) affecting versions 8.61-8.63. Difficult to exploit, requires high privileges and network access via HTTP; can lead to unauthorized access to critical data, with potential impact on other products.
- CVE-2026-101422High
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, Report Distribution component, affecting versions 8.61-8.63. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized creation, deletion or modification of critical data and causing hang or repeatable crashes (complete DOS).
- CVE-2026-101419Medium
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component SQR) affecting versions 8.61-8.63. Easily exploitable by a low-privileged attacker with network access via HTTP, allowing unauthorized access to critical data.
- CVE-2026-101418Medium
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component Report Distribution) affecting versions 8.61-8.63. Easily exploitable by a low-privileged attacker with network access via HTTP, allowing unauthorized access to critical data.
- CVE-2026-101413Medium
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Analytic Server) affecting versions 8.61-8.63. A low-privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DOS).
- CVE-2026-101409High
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, Report Distribution component, affecting versions 8.61-8.63. Easily exploitable by an unauthenticated attacker with HTTP network access, allowing unauthorized access to critical data or complete access to all PeopleTools data.
- CVE-2026-101420Critical
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (SQR component) affecting versions 8.61-8.63. A low-privileged attacker with network access via HTTP can easily gain unauthorized creation, deletion or modification access to critical data, potentially impacting other products. CVSS 9.6.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS