CVE-2026-91263: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-91263 is an authorization bypass vulnerability in the Notification Configuration component of Oracle PeopleSoft Enterprise PeopleTools. It affects supported versions 8.61 through 8.63 and was disclosed as part of Oracle's Critical Patch Update (CPU) in October 2026. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium), reflecting its network-accessible but high-complexity attack requirements (Oracle CPU Oct 2026).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified by Oracle, but characterized as an improper access control issue in the Notification Configuration component). A low-privileged attacker with network access via HTTP can exploit this flaw under high-complexity conditions — meaning specific preconditions or race conditions must be met — without requiring user interaction. Notably, the scope is marked as "Changed," indicating that a successful attack can impact resources beyond the directly vulnerable PeopleTools component, potentially affecting other PeopleSoft products (Oracle CPU Oct 2026).

Successful exploitation allows an authenticated low-privileged attacker to perform unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data, as well as unauthorized update, insert, or delete operations on some accessible data. The scope change designation means attacks may significantly impact additional PeopleSoft products beyond PeopleTools itself, increasing the potential blast radius. Availability is not impacted by this vulnerability (Oracle CPU Oct 2026).

As of the time of disclosure, there is no public proof-of-concept (PoC) exploit available and no evidence of in-the-wild exploitation. The EPSS score is reported at 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 389097), enabling vulnerability scanning for affected environments (Oracle CPU Oct 2026).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Organizations running PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 should apply the relevant patches immediately via the PeopleSoft patch availability documentation. As a temporary measure, Oracle recommends restricting network access to PeopleTools administration interfaces to trusted users and networks, and implementing network segmentation to limit exposure. Oracle strongly advises against relying on network-blocking workarounds as a long-term solution (Oracle CPU Oct 2026).