---
id: "CVE-2026-87401"
kind: "vulnerability"
aliases: ["CVE-2026-87401"]
title: "Oracle PeopleSoft PeopleTools: XML Publisher flaw leaks a subset of data"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-apps", "oracle", "peoplesoft", "peopletools", "vendor", "xml-publisher"]
not_affected_if: ["no-xml-publisher", "unsupported-version"]
published_at: "2026-10-20T22:20:18+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:46:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87401", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle PeopleSoft PeopleTools: XML Publisher flaw leaks a subset of data

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 have a flaw in the XML Publisher component. A low-privileged user with logon to the system can read a subset of data PeopleTools can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the PeopleTools version in use, for example in the PeopleSoft system information page (unknown if the sources do not say where to look)
- Check whether the installed version is within `8.61` to `8.63`

## Fix

- Apply the Oracle Critical Patch Update for PeopleSoft PeopleTools that addresses this CVE (exact patch name unknown from sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87401

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XML Publisher).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_