CVE-2026-21951: XSS
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21951?
CVE-2026-21951 is classified as an easily exploitable vulnerability that allows unauthenticated access to PeopleSoft applications.
How do I fix CVE-2026-21951?
To remediate CVE-2026-21951, update your PeopleSoft Enterprise PeopleTools to the latest versions beyond 8.62.
Which versions of PeopleSoft are affected by CVE-2026-21951?
CVE-2026-21951 affects Oracle PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, and 8.62.
What components of Oracle PeopleSoft are impacted by CVE-2026-21951?
CVE-2026-21951 impacts the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools.
Can CVE-2026-21951 be exploited remotely?
Yes, CVE-2026-21951 can be exploited remotely by an unauthenticated attacker with network access via HTTP.