{"id":"CVE-2026-101410","kind":"vulnerability","aliases":["CVE-2026-101410"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Business Interlink flaw allows takeover over HTTP","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a flaw in the Business Interlink component. A low-privileged attacker with network access over HTTP can take over the PeopleTools system.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle","package","peoplesoft","peopletools","self-hosted"],"not_affected_if":["no-network-exposure","unsupported-version"],"how_to_check":"- Confirm the PeopleTools release in use, e.g. the PeopleTools version shown in PeopleSoft Application Designer or the PeopleTools patch level, and compare against 8.61 to 8.63.\n- Check whether the Business Interlink component is deployed and reachable over HTTP.","fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise PeopleTools 8.61 to 8.63; the exact patch identifier is unknown from the sources.\n- Restrict HTTP access to Business Interlink to trusted networks until patched.","status":"open","published_at":"2026-10-20T22:17:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:22:42+00:00","updated_at":"2026-10-25T03:22:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:22:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise PeopleTools 8.61 to 8.63; the exact patch identifier is unknown from the sources.\n- Restrict HTTP access to Business Interlink to trusted networks until patched.","reach":"internet","title":"Oracle PeopleSoft PeopleTools: Business Interlink flaw allows takeover over HTTP","impact":"high","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a flaw in the Business Interlink component. A low-privileged attacker with network access over HTTP can take over the PeopleTools system.","category":"package","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","self-hosted","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the PeopleSoft PeopleTools system.","analyst_note":"Find the Oracle Critical Patch Update advisory and exact patch identifiers for PeopleTools 8.61-8.63 and whether Business Interlink is enabled by default.","how_to_check":"- Confirm the PeopleTools release in use, e.g. the PeopleTools version shown in PeopleSoft Application Designer or the PeopleTools patch level, and compare against 8.61 to 8.63.\n- Check whether the Business Interlink component is deployed and reachable over HTTP.","needs_analyst":true,"not_affected_if":["unsupported-version","no-network-exposure"],"who_is_affected":"Teams running Oracle PeopleSoft Enterprise PeopleTools in the affected versions 8.61 through 8.63 with the Business Interlink component reachable over HTTP. The sources do not say whether a default configuration exposes the component, so unknown whether systems on other releases or without network reach are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":3483,"output_tokens":693,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101410':13A,16A '-2026':12A,15A '-8.63':77C '/av':123C '3.1':110C,122C '7.5':113C '8.61':30B,76C '8.63':32B 'access':48B,88C 'affect':74C 'allow':7A,82C 'attack':45B,85C,97C 'avail':117C 'base':111C 'busi':4A,38B,68C 'compon':40B,67C 'compromis':92C 'confidenti':114C 'contain':33B 'cve':11A,14A 'cvss':109C,119C,121C 'difficult':78C 'enterpris':17B,27B,61C,94C,107C 'exploit':80C 'flaw':6A,35B 'h':131C 'h/a':130C 'h/i':129C 'h/pr':125C 'host':24B 'http':10A,50B,90C 'impact':118C 'integr':115C 'interlink':5A,39B,69C 'l/ui':126C 'low':43B,83C 'low-privileg':42B 'n/ac':124C 'n/s':127C 'network':47B,87C 'oracl':1A,18B,25B,65C 'packag':19B 'peoplesoft':2A,20B,26B,60C,66C,93C,106C 'peopletool':3A,21B,28B,55B,62C,95C,108C 'privileg':44B,84C 'product':63C 'result':102C 'score':112C 'self':23B 'self-host':22B 'success':96C 'support':70C 'system':56B 'take':52B 'takeov':8A,104C 'u/c':128C 'vector':120C 'version':29B,71C 'via':89C 'vulner':57C,81C,100C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle PeopleSoft Enterprise PeopleTools in the affected versions 8.61 through 8.63 with the Business Interlink component reachable over HTTP. The sources do not say whether a default configuration exposes the component, so unknown whether systems on other releases or without network reach are safe.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101410","severity":null,"published_at":"2026-10-20T22:17:49+00:00","modified_at":"2026-10-23T04:18:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}