---
id: "CVE-2026-101411"
kind: "vulnerability"
aliases: ["CVE-2026-101411"]
title: "Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated takeover over HTTP"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-erp", "oracle", "peoplesoft", "peopletools", "self-hosted", "vendor"]
not_affected_if: ["no-network-exposure", "other-peopletools-versions"]
published_at: "2026-10-20T22:17:49+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:06:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101411", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated takeover over HTTP

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a flaw in the Business Interlink component. A difficult-to-exploit flaw lets an unauthenticated attacker on the network send HTTP requests and take over the PeopleTools system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether PeopleTools is deployed and whether its version falls in `8.61` to `8.63`
- Check whether Business Interlink is in use on the PeopleSoft web tier (unknown if the sources say how to confirm)

## Fix

- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise PeopleTools (the sources do not name the patched version or patch number)
- Restrict HTTP access to the Business Interlink endpoints to trusted networks until patched

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101411

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_