CVE-2026-101390: PeopleSoft PeopleTools Auth Bypass

CVE-2026-101390 Overview

CVE-2026-101390 is a high-severity vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.61 through 8.63 and permits an unauthenticated remote attacker with network access over HTTP to compromise the application. Oracle disclosed the issue in the October 2026 Critical Patch Update. The weakness is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact

Successful exploitation results in full takeover of PeopleSoft Enterprise PeopleTools, with high impact to confidentiality, integrity, and availability.

Affected Products

• Oracle PeopleSoft Enterprise PeopleTools 8.61
• Oracle PeopleSoft Enterprise PeopleTools 8.62
• Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

• 2026-10-20 - CVE-2026-101390 published to NVD alongside the Oracle Critical Patch Update
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-101390

Vulnerability Analysis

The vulnerability resides in the Business Interlink component of PeopleSoft Enterprise PeopleTools. Business Interlink is a legacy framework used to integrate PeopleSoft with external systems over HTTP. The flaw allows an unauthenticated attacker to reach functionality that should require authentication, leading to complete system compromise.

Oracle rates the attack complexity as high, which indicates that exploitation requires specific preconditions or non-trivial preparation. However, no privileges and no user interaction are needed, and the attack is deliverable across a network. The EPSS score at publication is 0.348% (percentile 27.1), reflecting the elevated barrier to successful exploitation.

Root Cause

The weakness is categorized as [CWE-306: Missing Authentication for Critical Function]. The Business Interlink component exposes functionality over HTTP without enforcing the authentication checks required to protect it. An attacker who reaches the vulnerable endpoint can invoke operations that are intended for authenticated administrative contexts.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker crafts requests to the Business Interlink interface exposed by a vulnerable PeopleTools deployment. Successful requests yield takeover of the PeopleSoft Enterprise PeopleTools instance, including the ability to read, modify, and disrupt application data and services. Refer to the Oracle Security Alert: CPU October 2026 for Oracle's technical guidance.

No verified proof-of-concept code is publicly available at the time of writing. Readers should consult Oracle's advisory for implementation-specific details rather than relying on synthetic exploit code.

Detection Methods for CVE-2026-101390

Indicators of Compromise

• Unexpected HTTP requests to Business Interlink endpoints originating from untrusted networks or anomalous source addresses.
• Creation or modification of PeopleSoft administrative accounts, roles, or permission lists without a corresponding change record.
• Unusual outbound connections from PeopleTools application servers that may indicate post-exploitation command and control.

Detection Strategies

• Inspect web server and application server logs for unauthenticated requests reaching Business Interlink URLs and correlate with HTTP response codes indicating successful invocation.
• Monitor PeopleTools audit logs for configuration changes, new integration gateway entries, or privilege modifications that occur outside standard change windows.
• Baseline normal integration traffic patterns and alert on deviations in request volume, source geography, or user agents hitting Business Interlink endpoints.

Monitoring Recommendations

• Forward PeopleSoft web, application, and audit logs to a centralized SIEM for correlation across the stack.
• Enable file integrity monitoring on PeopleTools binaries, configuration files, and deployed Business Interlink definitions.
• Alert on process execution anomalies on the application server tier, particularly shell or scripting activity spawned by PeopleTools processes.

How to Mitigate CVE-2026-101390

Immediate Actions Required

• Apply the Oracle October 2026 Critical Patch Update to all PeopleSoft Enterprise PeopleTools instances running versions 8.61 through 8.63.
• Restrict network exposure of PeopleTools application servers so that Business Interlink endpoints are not reachable from untrusted networks or the public internet.
• Audit PeopleSoft accounts, roles, integration gateways, and recent configuration changes for signs of unauthorized modification.

Patch Information

Oracle addressed CVE-2026-101390 in the October 2026 Critical Patch Update. Administrators should review the Oracle Security Alert: CPU October 2026 and apply the PeopleTools patches corresponding to their deployed version.

Workarounds

• Place PeopleTools web and application tiers behind a reverse proxy or web application firewall that enforces authentication and blocks direct access to Business Interlink URLs.
• Disable the Business Interlink component where it is not required for active integrations, following Oracle's deprecation guidance.
• Enforce network segmentation and allowlist only known integration partners that must reach PeopleTools over HTTP.

# Example WAF rule concept: block unauthenticated access to Business Interlink paths
# Replace <bi-path> with your deployment's Business Interlink URI prefix
location ~* ^/<bi-path>/ {
    satisfy all;
    allow 10.0.0.0/8;      # internal integration network
    deny  all;
    auth_request /_auth;   # require upstream auth check
}