CVE-2026-34277: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-34277 is an authorization bypass vulnerability in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. Disclosed on April 21, 2026, as part of Oracle's Critical Patch Update (CPU) for April 2026, the vulnerability allows a high-privileged attacker with network access via HTTP to compromise the affected product with a scope change impacting additional products. It carries a CVSS v3.1 base score of 6.6 (Medium) (Oracle CPU April 2026, Github Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-400 (Uncontrolled Resource Consumption), indicating that the Fluid Core component fails to properly restrict access to resources and may allow resource exhaustion under certain conditions (Github Advisory). Exploitation requires a high-privileged account with network access over HTTP, and no user interaction is needed. The changed scope metric indicates that a successful attack can affect components or data beyond the directly vulnerable PeopleTools instance. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU April 2026).

A successful attack allows a high-privileged attacker to perform unauthorized data modification (insert, update, or delete), read a subset of accessible PeopleTools data, and cause a partial denial of service against PeopleSoft Enterprise PeopleTools. The scope change means that impacts may extend beyond the directly affected PeopleTools component to other integrated Oracle PeopleSoft products. Confidentiality, integrity, and availability are all partially affected, though the overall impact is limited in severity due to the high privilege requirement (Oracle CPU April 2026).

Oracle has released a patch for this vulnerability as part of the April 2026 Critical Patch Update (CPU), applicable to PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Organizations should apply the CPU April 2026 security patches as soon as possible. As interim mitigations, Oracle recommends restricting network access to PeopleSoft systems to authorized personnel only and enforcing the principle of least privilege for high-privileged accounts with HTTP access to affected systems (Oracle CPU April 2026).