{"id":"CVE-2026-101413","kind":"vulnerability","aliases":["CVE-2026-101413"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Analytic Server flaw lets low-privilege users crash service","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 have a flaw in the Analytic Server component. A low-privileged attacker with network access over HTTP can cause a hang or repeatable crash, denying service to the application.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle","peoplesoft","peopletools","self-hosted","vendor"],"not_affected_if":["other-peopletools-releases"],"how_to_check":"- Confirm the PeopleTools release in use: unknown\n- Check whether the Analytic Server component is deployed: unknown","fix":"- Apply the Oracle Critical Patch Update for PeopleSoft PeopleTools that covers the affected 8.61-8.63 releases: unknown","status":"open","published_at":"2026-10-20T22:17:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:24:30+00:00","updated_at":"2026-10-25T04:24:30+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:24:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for PeopleSoft PeopleTools that covers the affected 8.61-8.63 releases: unknown","reach":"network","title":"Oracle PeopleSoft PeopleTools: Analytic Server flaw lets low-privilege users crash service","impact":"low","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 have a flaw in the Analytic Server component. A low-privileged attacker with network access over HTTP can cause a hang or repeatable crash, denying service to the application.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","self-hosted","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service hangs or repeatedly crashes, denying availability to PeopleSoft users","analyst_note":"Check the Oracle Critical Patch Update advisory for the patch name and whether Analytic Server is enabled by default; the NVD entry gives no fix version.","how_to_check":"- Confirm the PeopleTools release in use: unknown\n- Check whether the Analytic Server component is deployed: unknown","needs_analyst":true,"not_affected_if":["other-peopletools-releases"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 with the Analytic Server component reachable over HTTP from users with low-privilege accounts. Sources do not say which deployment settings expose the component, so teams on other PeopleTools releases or without Analytic Server can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3499,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101413':16A,19A '-2026':15A,18A '-8.63':86C '/av':140C '3.1':130C,139C '5.3':133C '8.61':33B,85C '8.63':35B 'abil':114C 'access':51B,97C 'affect':83C 'allow':91C 'analyt':4A,41B,77C 'applic':65B 'attack':48B,94C,106C 'avail':134C 'base':131C 'caus':55B,116C 'complet':123C 'compon':43B,76C 'compromis':101C 'crash':12A,60B,122C 'cve':14A,17A 'cvss':129C,136C,138C 'deni':61B 'difficult':87C 'dos':124C 'enterpris':20B,30B,70C,103C,127C 'exploit':89C 'flaw':6A,38B 'frequent':120C 'h':148C 'h/pr':142C 'hang':57B,118C 'host':26B 'http':53B,99C 'impact':135C 'l/ui':143C 'let':7A 'low':9A,46B,92C 'low-privileg':8A,45B 'n/a':147C 'n/ac':141C 'n/i':146C 'n/s':144C 'network':50B,96C 'oracl':1A,21B,28B,74C 'peoplesoft':2A,22B,29B,69C,75C,102C,126C 'peopletool':3A,23B,31B,71C,104C,128C 'privileg':10A,47B,93C 'product':72C 'repeat':59B,121C 'result':111C 'score':132C 'self':25B 'self-host':24B 'server':5A,42B,78C 'servic':13A,62B 'success':105C 'support':79C 'u/c':145C 'unauthor':113C 'user':11A 'vector':137C 'vendor':27B 'version':32B,80C 'via':98C 'vulner':66C,90C,109C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 with the Analytic Server component reachable over HTTP from users with low-privilege accounts. Sources do not say which deployment settings expose the component, so teams on other PeopleTools releases or without Analytic Server can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101413","severity":null,"published_at":"2026-10-20T22:17:49+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}