{"id":"CVE-2026-91519","kind":"vulnerability","aliases":["CVE-2026-91519"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged users","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"A flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools lets an attacker with a low-privileged account reach data over HTTP. Successful exploitation exposes critical data accessible within PeopleTools, per Oracle's description (CVSS 6.5, confidentiality impact only).","severity":"medium","cvss":6.5,"epss":0.00355,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle","peoplesoft","peopletools","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed PeopleTools version against the affected range `8.61` to `8.63` in the Oracle PeopleSoft installation\n- Confirm whether the Report Distribution component is in use on the PeopleSoft environment\n- unknown for other checks, the sources do not say","fix":"- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools that addresses this CVE, moving off `8.61` to `8.63`\n- unknown for the exact patch identifier, the sources do not say","status":"open","published_at":"2026-10-20T22:20:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:49:22+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:22Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools that addresses this CVE, moving off `8.61` to `8.63`\n- unknown for the exact patch identifier, the sources do not say","reach":"internet","title":"Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged users","impact":"medium","summary":"A flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools lets an attacker with a low-privileged account reach data over HTTP. Successful exploitation exposes critical data accessible within PeopleTools, per Oracle's description (CVSS 6.5, confidentiality impact only).","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged user reads critical PeopleTools data over HTTP","analyst_note":"Confirm the patch identifier and remediation steps from Oracle's Critical Patch Update advisory and check the NVD entry for any configuration details.","how_to_check":"- Check the installed PeopleTools version against the affected range `8.61` to `8.63` in the Oracle PeopleSoft installation\n- Confirm whether the Report Distribution component is in use on the PeopleSoft environment\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools in the affected supported versions, 8.61 through 8.63, where users can reach the application over HTTP. The sources do not say whether a default configuration is exposed or which deployments are most at risk. Teams on unaffected PeopleTools versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":3491,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-8.63':88C '-91519':16A,19A '/av':140C '3.1':130C,139C '6.5':65B,133C '8.61':87C 'access':57B,98C,115C,121C,127C 'account':47B 'affect':85C 'allow':92C 'attack':41B,95C,107C 'base':131C 'complet':120C 'compon':33B,78C 'compromis':102C 'confidenti':66B,134C 'critic':55B,117C 'cve':14A,17A 'cvss':64B,129C,136C,138C 'data':8A,49B,56B,118C,128C 'descript':63B 'distribut':5A,32B,80C 'easili':89C 'enterpris':37B,72C,104C,125C 'exploit':53B,90C 'expos':7A,54B 'flaw':6A,28B 'h/i':146C 'http':51B,100C 'impact':67B,135C 'l/pr':142C 'l/ui':143C 'let':39B 'low':11A,45B,93C 'low-privileg':10A,44B 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'network':97C 'on-prem':20B 'oracl':1A,23B,35B,61B,76C 'peoplesoft':2A,24B,36B,71C,77C,103C,124C 'peopletool':3A,25B,38B,59B,73C,105C,126C 'per':60B 'prem':22B 'privileg':12A,46B,94C 'product':74C 'reach':48B 'report':4A,31B,79C 'result':112C 'score':132C 'success':52B,106C 'support':81C 'u/c':145C 'unauthor':114C 'user':13A 'vector':137C 'vendor':26B 'version':82C 'via':99C 'vulner':68C,91C,110C 'within':58B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools in the affected supported versions, 8.61 through 8.63, where users can reach the application over HTTP. The sources do not say whether a default configuration is exposed or which deployments are most at risk. Teams on unaffected PeopleTools versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91519","severity":null,"published_at":"2026-10-20T22:20:55+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91519","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91519","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}