CVE-2026-83018: High severity Oracle PeopleSoft Enterprise PeopleTools vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the PeopleSoft Enterprise PeopleTools execution environment (component: SQR) so only trusted users/systems can reach it, since the vulnerability is exploitable by low-privileged attackers with logon (CVSS:3.1 AV:L, PR:L).
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
PeopleSoft Enterprise PeopleTools deployments using the SQR component on supported affected versions 8.61 through 8.63 are exposed. Exploitation requires an attacker to have a low-privileged logon to the infrastructure where PeopleSoft Enterprise PeopleTools runs.
Does an attacker need user interaction or remote network access?
No user interaction is required. The CVSS vector identifies the attack vector as local, so the attacker must already be able to access the executing infrastructure rather than exploiting it solely over the network.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of PeopleSoft Enterprise PeopleTools. Confidentiality, integrity, and availability can all be fully impacted.