{"id":"CVE-2026-87349","kind":"vulnerability","aliases":["CVE-2026-87349"],"related":[],"title":"Oracle PeopleSoft PeopleTools: security flaw allows takeover by a privileged user","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a security flaw in the Security component. An attacker with high privileges and a logon to the host infrastructure can take over PeopleTools, but a second person must take an action to complete the attack.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle","peoplesoft","peopletools","vendor"],"not_affected_if":["no-peoplesoft","other-peopletools-release"],"how_to_check":"- Confirm the PeopleTools release in use is 8.61, 8.62 or 8.63 (unknown how the sources say to read this on the install)\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE (unknown from sources)","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-87349 for PeopleSoft Enterprise PeopleTools 8.61 to 8.63 (exact patch id unknown from sources)","status":"open","published_at":"2026-10-20T22:20:12+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:22+00:00","updated_at":"2026-10-25T03:51:22+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:51:22Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-87349 for PeopleSoft Enterprise PeopleTools 8.61 to 8.63 (exact patch id unknown from sources)","reach":"local","title":"Oracle PeopleSoft PeopleTools: security flaw allows takeover by a privileged user","impact":"high","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a security flaw in the Security component. An attacker with high privileges and a logon to the host infrastructure can take over PeopleTools, but a second person must take an action to complete the attack.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over PeopleSoft PeopleTools after privileged logon","analyst_note":"Find the Oracle CPU advisory entry for CVE-2026-87349 to get the patch id and the exact affected release list.","how_to_check":"- Confirm the PeopleTools release in use is 8.61, 8.62 or 8.63 (unknown how the sources say to read this on the install)\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE (unknown from sources)","needs_analyst":true,"not_affected_if":["other-peopletools-release","no-peoplesoft"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 are affected, with the risk concentrated on hosts where PeopleTools runs. The attacker must already hold high privileges and a logon to that infrastructure, and a person other than the attacker must interact for the attack to succeed. Teams on other PeopleTools releases or without PeopleSoft can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":3519,"output_tokens":694,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-8.63':88C '-87349':14A,17A '/av':150C '3.1':137C,149C '6.5':140C '8.61':30B,87C '8.63':32B 'action':64B 'affect':85C 'allow':6A,92C 'app':20B 'attack':42B,68B,95C,112C,122C,124C 'avail':144C 'base':138C 'complet':66B 'compon':40B,79C 'compromis':107C 'confidenti':141C 'contain':33B 'cve':12A,15A 'cvss':136C,146C,148C 'easili':89C 'enterpris':19B,27B,73C,103C,109C,134C 'enterprise-app':18B 'execut':105C 'exploit':90C 'flaw':5A,36B 'h':158C 'h/a':157C 'h/i':156C 'h/ui':153C 'high':44B,93C 'host':51B 'human':114C 'impact':145C 'infrastructur':52B,100C 'integr':142C 'interact':115C 'l/ac':151C 'l/pr':152C 'logon':48B,97C 'must':61B 'oracl':1A,21B,25B,77C 'peoplesoft':2A,22B,26B,72C,78C,102C,108C,133C 'peopletool':3A,23B,28B,56B,74C,104C,110C,135C 'person':60B,118C 'privileg':10A,45B,94C 'product':75C 'r/s':154C 'requir':113C 'result':129C 'score':139C 'second':59B 'secur':4A,35B,39B,80C 'success':111C,123C 'support':81C 'take':54B,62B 'takeov':7A,131C 'u/c':155C 'user':11A 'vector':147C 'vendor':24B 'version':29B,82C 'vulner':69C,91C,127C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 are affected, with the risk concentrated on hosts where PeopleTools runs. The attacker must already hold high privileges and a logon to that infrastructure, and a person other than the attacker must interact for the attack to succeed. Teams on other PeopleTools releases or without PeopleSoft can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87349","severity":null,"published_at":"2026-10-20T22:20:12+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}