---
id: "CVE-2026-101410"
kind: "vulnerability"
aliases: ["CVE-2026-101410"]
title: "Oracle PeopleSoft PeopleTools: Business Interlink flaw allows takeover over HTTP"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["enterprise", "oracle", "package", "peoplesoft", "peopletools", "self-hosted"]
not_affected_if: ["no-network-exposure", "unsupported-version"]
published_at: "2026-10-20T22:17:49+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:22:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101410", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Business Interlink flaw allows takeover over HTTP

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a flaw in the Business Interlink component. A low-privileged attacker with network access over HTTP can take over the PeopleTools system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the PeopleTools release in use, e.g. the PeopleTools version shown in PeopleSoft Application Designer or the PeopleTools patch level, and compare against 8.61 to 8.63.
- Check whether the Business Interlink component is deployed and reachable over HTTP.

## Fix

- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise PeopleTools 8.61 to 8.63; the exact patch identifier is unknown from the sources.
- Restrict HTTP access to Business Interlink to trusted networks until patched.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101410

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_