CVE-2026-21938
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-01-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | 8.60 |
| oracle | peoplesoft_enterprise_peopletools | 8.61 |
| oracle | peoplesoft_enterprise_peopletools | 8.62 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the PeopleSoft Enterprise PeopleTools product, specifically in the Portal component, affecting versions 8.60, 8.61, and 8.62. It allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack requires human interaction from someone other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data within PeopleSoft Enterprise PeopleTools.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized modification (update, insert, delete) and unauthorized reading of some data within PeopleSoft Enterprise PeopleTools. This can lead to data integrity and confidentiality issues, potentially affecting additional products due to the scope change. The vulnerability has a CVSS base score of 6.1, indicating a moderate severity with confidentiality and integrity impacts but no availability impact.