CVE-2026-101416

Analyzed Analyzed - Analysis Complete

Remote Code Execution in PeopleSoft Enterprise PeopleTools

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101416

EUVD

EUVD-2026-105832

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_peopletools	From 8.61 (inc) to 8.63 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. It allows an unauthenticated attacker with physical network access to take over the system. The attack requires access to the same physical communication segment as the hardware running PeopleSoft. Successful exploitation could lead to full system compromise.

Detection Guidance

Detection requires identifying unpatched PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Check installed versions via PeopleSoft administration tools or database queries. Monitor network segments for unauthorized access attempts to PsAdmin components. Review system logs for suspicious activity related to PeopleSoft services.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain complete control over your PeopleSoft Enterprise PeopleTools system. This could lead to unauthorized access to sensitive data, modification or deletion of critical information, and disruption of services. The impact includes confidentiality, integrity, and availability breaches.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by enabling unauthorized access to personal or health data. A successful attack may result in data breaches, violating confidentiality requirements and potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Apply Oracle's official security patches immediately. Isolate PeopleSoft servers on restricted network segments. Disable unnecessary services and restrict physical access to hardware. Implement network monitoring for anomalous PsAdmin activity. Review and update authentication mechanisms.

Hi! I’m here to help you understand CVE-2026-101416. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...