---
id: "CVE-2026-101390"
kind: "vulnerability"
aliases: ["CVE-2026-101390"]
title: "Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated server takeover"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-erp", "oracle", "peoplesoft", "peopletools", "self-hosted", "vendor"]
not_affected_if: ["not-network-exposed", "unsupported-version"]
published_at: "2026-10-20T22:17:46+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:06:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101390", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated server takeover

A flaw in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools can be triggered over HTTP by an unauthenticated attacker with network access. Successful exploitation can lead to full takeover of the PeopleTools installation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PeopleTools release against the affected range 8.61 to 8.63 in the PeopleTools version information
- Confirm whether Business Interlink is deployed and reachable over HTTP
- unknown for any further check the sources do not describe

## Fix

- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools covering Business Interlink, for supported versions 8.61 to 8.63
- unknown for the specific patch identifier, since the sources do not name one

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101390

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_