{"id":"CVE-2026-87401","kind":"vulnerability","aliases":["CVE-2026-87401"],"related":[],"title":"Oracle PeopleSoft PeopleTools: XML Publisher flaw leaks a subset of data","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XML Publisher).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 have a flaw in the XML Publisher component. A low-privileged user with logon to the system can read a subset of data PeopleTools can access.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle","peoplesoft","peopletools","vendor","xml-publisher"],"not_affected_if":["no-xml-publisher","unsupported-version"],"how_to_check":"- Confirm the PeopleTools version in use, for example in the PeopleSoft system information page (unknown if the sources do not say where to look)\n- Check whether the installed version is within `8.61` to `8.63`","fix":"- Apply the Oracle Critical Patch Update for PeopleSoft PeopleTools that addresses this CVE (exact patch name unknown from sources)","status":"open","published_at":"2026-10-20T22:20:18+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:46:05+00:00","updated_at":"2026-10-25T04:46:05+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:46:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for PeopleSoft PeopleTools that addresses this CVE (exact patch name unknown from sources)","reach":"local","title":"Oracle PeopleSoft PeopleTools: XML Publisher flaw leaks a subset of data","impact":"low","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 have a flaw in the XML Publisher component. A low-privileged user with logon to the system can read a subset of data PeopleTools can access.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","xml-publisher","enterprise-apps"],"confidence":0.7,"needs_auth":"yes","worst_case":"low-privileged user reads a subset of PeopleTools data","analyst_note":"","how_to_check":"- Confirm the PeopleTools version in use, for example in the PeopleSoft system information page (unknown if the sources do not say where to look)\n- Check whether the installed version is within `8.61` to `8.63`","needs_analyst":false,"not_affected_if":["unsupported-version","no-xml-publisher"],"who_is_affected":"PeopleSoft Enterprise PeopleTools installations in versions 8.61 to 8.63 that expose the XML Publisher component. Attackers need a logon to the infrastructure where PeopleTools runs, so systems limited to trusted internal users carry less risk. Organizations not running these versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000632,"input_tokens":3509,"output_tokens":562,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-8.63':83C '-87401':14A,17A '/av':137C '3.1':127C,136C '3.3':130C '8.61':33B,82C '8.63':35B 'access':62B,116C,124C 'affect':80C 'allow':87C 'app':20B 'attack':90C,107C 'base':128C 'compon':43B,73C 'compromis':102C 'confidenti':131C 'cve':12A,15A 'cvss':126C,133C,135C 'data':11A,59B,125C 'easili':84C 'enterpris':19B,30B,67C,98C,104C,122C 'enterprise-app':18B 'execut':100C 'exploit':85C 'flaw':6A,38B 'impact':132C 'infrastructur':95C 'l/ac':138C 'l/i':143C 'l/pr':139C 'l/ui':140C 'leak':7A 'logon':50B,92C 'low':46B,88C 'low-privileg':45B 'n':145C 'n/a':144C 'n/s':141C 'oracl':1A,21B,28B,71C 'peoplesoft':2A,22B,29B,66C,72C,97C,103C,121C 'peopletool':3A,23B,31B,60B,68C,99C,105C,123C 'privileg':47B,89C 'product':69C 'publish':5A,27B,42B,75C 'read':55B,115C 'result':112C 'score':129C 'subset':9A,57B,119C 'success':106C 'support':76C 'system':53B 'u/c':142C 'unauthor':114C 'user':48B 'vector':134C 'vendor':24B 'version':32B,77C 'vulner':63C,86C,110C 'xml':4A,26B,41B,74C 'xml-publish':25B","nicknames":[],"mitigations":[],"who_affected":"PeopleSoft Enterprise PeopleTools installations in versions 8.61 to 8.63 that expose the XML Publisher component. Attackers need a logon to the infrastructure where PeopleTools runs, so systems limited to trusted internal users carry less risk. Organizations not running these versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87401","severity":null,"published_at":"2026-10-20T22:20:18+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}