CVE-2026-91505: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-91505 is a vulnerability in the Porting component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. It allows a high-privileged attacker with local logon access to the infrastructure to compromise the system, resulting in unauthorized read, create, delete, or modify access to critical data. The vulnerability was disclosed as part of Oracle's Critical Patch Update (CPU) for October 2026, published on October 20, 2026. It carries a CVSS v3.1 base score of 6.0 (Medium) (Oracle CPU Oct 2026).

The vulnerability resides in the Porting component of PeopleSoft Enterprise PeopleTools and is classified as an elevation of privilege issue. Exploitation requires an attacker to already have high-privileged local access (logon) to the infrastructure where PeopleTools executes, making the attack vector local with low attack complexity and no user interaction required. The vulnerability impacts both confidentiality and integrity (both rated High), with no availability impact, and the scope remains unchanged. No specific CWE classification or technical write-up has been publicly disclosed beyond Oracle's advisory (Oracle CPU Oct 2026).

Successful exploitation allows a high-privileged local attacker to gain unauthorized read access to all data accessible by PeopleSoft Enterprise PeopleTools, as well as the ability to create, delete, or modify critical data within the system. The impact is limited to confidentiality and integrity — availability is not affected. The scope is confined to the PeopleTools environment, but exposure of critical business data (HR, financial, supply chain) managed by PeopleSoft could have significant downstream consequences (Oracle CPU Oct 2026).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability requires high privileges and local access, significantly limiting the attacker pool. The EPSS score is 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 389097) (Oracle CPU Oct 2026).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Affected versions are PeopleSoft Enterprise PeopleTools 8.61 and 8.62; administrators should apply the patches provided in the Oracle CPU October 2026 advisory immediately. As interim measures, Oracle recommends restricting local logon access to the PeopleTools infrastructure to only authorized high-privilege administrators, implementing access controls and monitoring for high-privilege accounts, and auditing recent changes to critical data. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle CPU Oct 2026).