CVE-2026-87264: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-87264 is a data tampering vulnerability in the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. It was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data, with a scope change that may impact additional connected products. It carries a CVSS v3.1 base score of 7.7 (High) (Oracle Advisory, Github Advisory).

The vulnerability resides in the Integration Broker component of PeopleSoft Enterprise PeopleTools, which handles inter-system messaging and service integrations over HTTP. An attacker with low-level authenticated access can exploit this flaw over the network without user interaction, making it easily exploitable under low attack complexity conditions. The scope change (S:C) in the CVSS vector indicates that a successful attack can affect resources beyond the directly vulnerable component, potentially impacting other systems integrated via the broker. No specific CWE classification has been assigned, and no public technical write-up or proof-of-concept code has been identified (Oracle Advisory, Github Advisory).

Successful exploitation allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical data accessible to PeopleSoft Enterprise PeopleTools, resulting in a high integrity impact. There is no confidentiality or availability impact identified. Due to the scope change, attacks may extend beyond the PeopleTools environment to affect other integrated products or downstream systems connected through the Integration Broker, amplifying the potential business impact (Oracle Advisory, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.255% (17th percentile), indicating a low near-term probability of exploitation. No threat actor attribution has been reported.

Oracle released patches for this vulnerability on September 15, 2026, as part of the September 2026 Critical Security Patch Update. Organizations should apply the available patches for PeopleSoft Enterprise PeopleTools versions 8.61–8.63 immediately. As interim mitigations, Oracle recommends restricting network access to the Integration Broker component to authorized users and systems only, implementing network segmentation to limit PeopleSoft system exposure, and monitoring for unauthorized data modifications in PeopleSoft databases. Oracle strongly advises against relying on network-level workarounds as a long-term solution (Oracle Advisory).