CVE-2026-83018: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-83018 is a local privilege escalation vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. The vulnerability allows a low-privileged attacker with local logon access to the infrastructure to fully compromise the PeopleSoft Enterprise PeopleTools system. It was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). The CVSS v3.1 base score is 7.8 (High) (Oracle Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control), with an estimated association to CWE-269 (Improper Privilege Management), residing in the SQR component of PeopleTools. The attack vector is local, requiring only low privileges and no user interaction, with low attack complexity — making it straightforward for any authenticated local user to attempt exploitation. The flaw enables a low-privileged attacker to escalate privileges and achieve complete takeover of the PeopleSoft Enterprise PeopleTools environment. No technical write-ups or public proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation results in a complete compromise of the affected PeopleSoft Enterprise PeopleTools instance, with high impact to confidentiality, integrity, and availability. An attacker gaining full control could access sensitive enterprise data (HR, financial, or operational records), modify system configurations or data, and disrupt availability of PeopleSoft services. The scope is unchanged, meaning the impact is contained to the compromised system, but lateral movement within the enterprise environment remains a risk given PeopleSoft's typical integration with broader organizational infrastructure (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.162%, indicating a low probability of exploitation in the near term. The attack is not automatable (per NVD SSVC assessment), as it requires local logon access to the target infrastructure (Oracle Advisory).

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update (CSPU), available as of September 15, 2026. Affected versions are PeopleSoft Enterprise PeopleTools 8.61 through 8.63; organizations should apply the patch immediately. As interim mitigations, Oracle recommends restricting local logon access to the PeopleSoft infrastructure to only trusted and essential users, implementing access controls and monitoring for suspicious local authentication activity, and minimizing privileges assigned to non-administrative accounts with local access (Oracle Advisory).