CVE-2026-47049: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-47049 is a data disclosure vulnerability in the PIA Core Technology component of Oracle PeopleSoft Enterprise PeopleTools. It affects supported versions 8.61 and 8.62, and was disclosed as part of Oracle's Critical Patch Update (CPU) on July 21, 2026. The vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory).

The vulnerability resides in the PIA (PeopleSoft Internet Architecture) Core Technology component of PeopleSoft Enterprise PeopleTools, classified as a file/data disclosure issue. It is described as "easily exploitable" and requires no user interaction, but does require high privileges and network access via HTTP. The attack vector is network-based with low complexity, and the scope is unchanged, meaning the impact is confined to the vulnerable component itself. No specific CWE classification or detailed technical write-up has been publicly disclosed beyond Oracle's advisory (Oracle Advisory).

Successful exploitation results exclusively in a confidentiality impact — an authenticated high-privileged attacker can read unauthorized critical data or gain complete access to all data accessible within PeopleSoft Enterprise PeopleTools. There is no integrity or availability impact. Given PeopleSoft's typical deployment in enterprise HR, finance, and campus management environments, exposed data could include sensitive employee, financial, or student records (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update, and customers should apply the relevant PeopleSoft patches immediately. As an interim measure, Oracle recommends restricting network access to the PIA Core Technology component to only authorized high-privileged users, implementing network segmentation, and monitoring for suspicious access patterns from privileged accounts. Oracle strongly advises against relying on network-level workarounds as a long-term solution, as they do not address the underlying vulnerability (Oracle Advisory).