CVE-2026-101388: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-101388 Overview

CVE-2026-101388 is a vulnerability in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. Supported versions 8.61 through 8.63 are affected. A low-privileged attacker with network access over HTTP can exploit this flaw to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation can grant unauthorized access to critical PeopleSoft data and cause a partial denial of service of the application.

Oracle disclosed the issue as part of the October 2026 Critical Patch Update advisory. The vulnerability is network-reachable, has low attack complexity, and requires authentication but no user interaction.

Critical Impact
Authenticated attackers can read all PeopleSoft Enterprise PeopleTools accessible data and cause partial service disruption through the Portal component over the network.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-10-20 - CVE-2026-101388 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Security Alert - October 2026

Technical Details for CVE-2026-101388

Vulnerability Analysis

The vulnerability resides in the Portal component of PeopleSoft Enterprise PeopleTools. The Portal provides the primary web-facing interface for PeopleSoft applications, handling navigation, content aggregation, and session context for authenticated users. A flaw in how the Portal processes HTTP requests allows an authenticated low-privileged user to access data beyond their intended authorization boundary.

The scope is unchanged, meaning the impact remains within the vulnerable PeopleTools instance. However, the confidentiality impact is high: an attacker can retrieve the full set of data accessible to PeopleSoft Enterprise PeopleTools. The availability impact is partial, suggesting the exploit path can also degrade specific Portal functions without causing a full outage. Integrity is not affected.

Oracle has not published CWE identifiers or exploit technical details. The characteristics are consistent with a broken access control or authorization bypass flaw reachable through the Portal's HTTP interface.

Root Cause

Oracle's advisory does not disclose the root cause. Based on the attack profile, the issue likely stems from improper access control enforcement within a Portal request handler. The specific function and request path are not documented in public references.

Attack Vector

Exploitation requires network access to the PeopleSoft Portal over HTTP and a valid low-privileged account. No user interaction is needed. An attacker sends crafted HTTP requests to Portal endpoints to retrieve data belonging to other users or to trigger a partial denial of service of specific Portal functions. The EPSS score is 0.38% at the 30.76 percentile, indicating a low current probability of mass exploitation.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert - October 2026 for Oracle-authenticated technical references.

Detection Methods for CVE-2026-101388

Indicators of Compromise

Unusual volume of HTTP requests from a single low-privileged PeopleSoft account to Portal endpoints such as /psp/ and /psc/ URIs.
Portal access log entries showing a single session enumerating content references or component URLs across multiple functional pillars.
Spikes in HTTP 5xx responses or elevated response latency from the Portal servlet correlated with a specific authenticated session.

Detection Strategies

Baseline normal Portal navigation patterns per role and alert when a low-privileged user accesses components outside their assigned permission lists.
Correlate PeopleSoft application server (APPSRV) logs with web server access logs to identify authorization anomalies on Portal requests.
Review PeopleTools security audit tables (PSACCESSLOG, PSAUDIT) for unexpected access to sensitive component definitions.

Monitoring Recommendations

Forward web server, PIA, and application server logs to a centralized analytics platform and retain for incident review.
Monitor authenticated session behavior for data exfiltration patterns such as repeated page scraping or query component enumeration.
Track failed and successful authorization checks surfaced by PeopleTools security logging.

How to Mitigate CVE-2026-101388

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools to all affected instances running 8.61, 8.62, or 8.63.
Inventory internet-exposed PeopleSoft Portal deployments and prioritize patching external-facing systems first.
Review PeopleTools user accounts, disable unused low-privileged accounts, and enforce strong authentication on remaining accounts.
Rotate credentials for any accounts suspected of unauthorized use since the publication date.

Patch Information

Oracle addressed CVE-2026-101388 in the October 2026 Critical Patch Update. Administrators should download and apply the PeopleTools patch bundle referenced in the Oracle Security Alert - October 2026. Oracle supports only the versions listed; upgrade unsupported deployments before applying the fix.

Workarounds

Restrict Portal access to trusted networks using a web application firewall or reverse proxy enforcing IP allowlists.
Enforce multi-factor authentication at the identity provider layer in front of PeopleSoft single sign-on to reduce exploitation by compromised low-privileged accounts.
Reduce assigned permission lists and roles to the minimum required, limiting the data reachable through the Portal by any single account.

bash

# Example reverse proxy restriction limiting Portal access to internal networks
location /psp/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass https://peoplesoft-portal.internal;
}