CVE-2026-91519: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-91519 is a data disclosure vulnerability in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools. It affects supported versions 8.61 through 8.63 and allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical or complete PeopleTools-accessible data. The vulnerability was disclosed as part of Oracle's October 2026 Critical Patch Update (CPU), published on October 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle CPU Oct 2026).

The vulnerability is classified as a file/data disclosure issue (attack type: File / Data Disclosure) within the Report Distribution component of PeopleSoft Enterprise PeopleTools. It is easily exploitable by a low-privileged attacker over the network via HTTP, requiring no user interaction and no elevated privileges beyond a basic authenticated account (CWE classification not explicitly stated by Oracle). The attack vector is network-based with low attack complexity, meaning exploitation does not require special conditions or race conditions — any authenticated low-privileged user with HTTP access to the affected component can trigger the vulnerability (Oracle CPU Oct 2026).

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible within PeopleSoft Enterprise PeopleTools, representing a high confidentiality impact. There is no integrity or availability impact associated with this vulnerability. Given that PeopleSoft environments typically host sensitive HR, financial, and operational data, exposure could include personally identifiable information (PII), payroll records, and enterprise business data (Oracle CPU Oct 2026).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Oracle CPU Oct 2026). The EPSS score is reported at 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has released a patch for this vulnerability as part of the October 2026 Critical Patch Update; organizations should upgrade PeopleSoft Enterprise PeopleTools to a version beyond 8.63 by applying the CPU patch (Oracle CPU Oct 2026). As a temporary workaround, network access to the Report Distribution component via HTTP should be restricted to authorized users only. Oracle strongly recommends applying security patches as soon as possible rather than relying on network-level controls as a long-term solution. Access logs should be monitored for suspicious data access patterns originating from low-privileged accounts.