CVE-2026-91468: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-91468 is an authorization bypass vulnerability in the QAS component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. It allows unauthenticated attackers with network access via HTTP to perform unauthorized data modifications and cause a partial denial of service. The vulnerability was disclosed as part of Oracle's October 2026 Critical Patch Update (CPU), published on October 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle CPU Oct 2026).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified, but consistent with improper access control) in the QAS component of PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can exploit this flaw over HTTP with low attack complexity and no user interaction required, making it easily exploitable. The attack vector is network-based, and no privileges are required to trigger the vulnerability. No public proof-of-concept code or detailed technical write-up has been identified at this time (Oracle CPU Oct 2026).

Successful exploitation allows an unauthenticated attacker to perform unauthorized update, insert, or delete operations on some data accessible within PeopleSoft Enterprise PeopleTools, and to cause a partial denial of service of the QAS component. There is no confidentiality impact (no data disclosure), but integrity and availability are both affected at a low level. The scope of impact is limited to the affected PeopleTools instance and does not extend to other systems (Oracle CPU Oct 2026).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation reported at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Oracle CPU Oct 2026).

Oracle has released a patch for this vulnerability as part of the October 2026 Critical Patch Update. Organizations running PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 should apply the patch immediately. As a temporary measure, Oracle recommends restricting network-level HTTP access to the PeopleTools application to authorized users only, though this should not be considered a long-term solution. Monitoring the QAS component for unauthorized data modifications and unexpected service interruptions is also advised (Oracle CPU Oct 2026).