CVE-2026-83018

Analyzed Analyzed - Analysis Complete

PeopleTools SQR Code Execution Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83018

EUVD

EUVD-2026-79346

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_peopletools	From 8.61 (inc) to 8.63 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. It allows a low-privileged attacker with system access to take over the PeopleSoft Enterprise PeopleTools by exploiting a flaw in the SQR component. The attack requires local access but can lead to full system compromise.

Detection Guidance

This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Detection requires checking the installed version of PeopleSoft Enterprise PeopleTools on systems where it is deployed. Compare the installed version against the affected versions (8.61-8.63). If the version falls within this range, the system is potentially vulnerable.

Impact Analysis

If you use PeopleSoft Enterprise PeopleTools versions 8.61-8.63, an attacker with local access could gain control of the system. This could lead to unauthorized data access, modification, or deletion, disrupting business operations and compromising sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal or sensitive data, violating GDPR and HIPAA requirements. Compliance may be compromised if systems are not patched, potentially resulting in legal penalties or loss of certification.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Ensure only authorized users have logon access to the infrastructure where PeopleSoft Enterprise PeopleTools executes. Monitor for unusual activity in PeopleSoft Enterprise PeopleTools components.

Hi! I’m here to help you understand CVE-2026-83018. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70