CVE-2026-83015: High severity Oracle PeopleSoft Enterprise PeopleTools vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply compensating controls to reduce exposure to Cube Manager exploitation from low-privileged authenticated attackers against PeopleSoft Enterprise PeopleTools (Cube Manager), such as restricting network access to PeopleSoft Enterprise PeopleTools/Cube Manager to only required clients and limiting reachable services.
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Deployments running Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. Exploitation requires an attacker to have a low-privileged account and logon access to the infrastructure where PeopleTools executes.
Does an attacker need user interaction or remote network access?
No user interaction is required. The attack vector is local, so the attacker must be able to log on to the relevant PeopleTools infrastructure rather than merely reach it over the network.
What is the potential impact of successful exploitation?
A successful attack can result in takeover of PeopleSoft Enterprise PeopleTools. Confidentiality, integrity, and availability can all be fully impacted.
How difficult is exploitation according to the available assessment?
The vulnerability has high attack complexity. Despite this, an attacker with the required low-privileged local access may be able to compromise the product without user interaction.