CVE-2026-47048: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-47048 is a tampering vulnerability in the Security component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026. The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized data modifications and limited data reads, with a scope change that may impact additional connected products. It carries a CVSS v3.1 base score of 5.4 (Medium) (Oracle Advisory).

The vulnerability resides in the Security component of PeopleSoft Enterprise PeopleTools and is classified as a tampering/Cross-Site Scripting-type issue (consistent with CWE patterns involving scope change and user interaction requirements). Exploitation requires a low-privileged attacker with network access over HTTP and necessitates human interaction from a victim user — a pattern typical of stored or reflected injection attacks where a malicious payload is delivered to another user's session. The changed scope indicator suggests that a successful attack can affect resources beyond the vulnerable component itself, potentially impacting other PeopleSoft modules or integrated systems (Oracle Advisory).

Successful exploitation results in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data (confidentiality impact) and unauthorized update, insert, or delete access to some accessible data (integrity impact). There is no availability impact. The scope change means that exploitation could affect additional Oracle PeopleSoft products beyond PeopleTools itself, potentially exposing sensitive HR, financial, or student records managed within the PeopleSoft ecosystem (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update, applicable to PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Organizations should apply the CPU patches immediately via the PeopleSoft patch availability documentation. As interim measures, Oracle recommends restricting HTTP network access to PeopleSoft systems to authorized users only, implementing multi-factor authentication, and educating users to avoid interacting with suspicious links or requests, since exploitation requires user interaction (Oracle Advisory).