---
id: "CVE-2026-91519"
kind: "vulnerability"
aliases: ["CVE-2026-91519"]
title: "Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["on-prem", "oracle", "peoplesoft", "peopletools", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-20T22:20:55+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:49:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91519", "first_seen_at": "2026-10-23T21:57:27+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged users

A flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools lets an attacker with a low-privileged account reach data over HTTP. Successful exploitation exposes critical data accessible within PeopleTools, per Oracle's description (CVSS 6.5, confidentiality impact only).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PeopleTools version against the affected range `8.61` to `8.63` in the Oracle PeopleSoft installation
- Confirm whether the Report Distribution component is in use on the PeopleSoft environment
- unknown for other checks, the sources do not say

## Fix

- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools that addresses this CVE, moving off `8.61` to `8.63`
- unknown for the exact patch identifier, the sources do not say

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91519

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_