CVE-2026-91497: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-91497 is a data tampering vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, specifically within the Updates Environment Mgmt component. It affects supported versions 8.61 through 8.63 and allows an unauthenticated attacker with network access via HTTP to perform unauthorized data modifications. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory).

The vulnerability is classified as an integrity-impacting flaw (CWE not explicitly specified by Oracle) in the Updates Environment Mgmt component of PeopleSoft Enterprise PeopleTools. It is easily exploitable over the network via HTTP with no authentication, no user interaction, and low attack complexity required, indicating the vulnerable endpoint is exposed without access controls. Successful exploitation allows an attacker to perform unauthorized update, insert, or delete operations on a subset of accessible PeopleSoft data. The vulnerability was reported to Oracle by researcher Xiang Chen (Oracle Advisory).

Exploitation of this vulnerability results in a limited integrity impact — an unauthenticated remote attacker can modify, insert, or delete some data accessible within the PeopleSoft Enterprise PeopleTools Updates Environment Mgmt component. There is no confidentiality or availability impact, and the scope is unchanged, meaning the attack is contained to the vulnerable component. While the impact is bounded, unauthorized data manipulation in an enterprise resource planning environment could disrupt update management workflows or introduce malicious configuration changes (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is reported as 0.0, reflecting a currently low probability of exploitation (Oracle Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation evidence, the lack of authentication requirement and low attack complexity make it straightforward to exploit if the endpoint is network-accessible.

Oracle has released a patch for this vulnerability as part of the October 2026 Critical Patch Update. Administrators should apply the patch immediately for affected PeopleSoft Enterprise PeopleTools versions 8.61–8.63 by following the instructions in the Oracle patch availability documentation. As a temporary workaround, Oracle recommends blocking network access to the affected HTTP-based component at the network perimeter to reduce exposure until patching is complete. Oracle strongly advises against relying on network blocking as a long-term solution (Oracle Advisory).