CVE-2026-101411: PeopleSoft Enterprise PeopleTools Auth Bypass

CVE-2026-101411 Overview

CVE-2026-101411 is a high-severity vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. Affected versions include PeopleTools 8.61 through 8.63. The flaw allows an unauthenticated remote attacker with network access over HTTP to compromise the application. Successful exploitation can lead to full takeover of PeopleSoft Enterprise PeopleTools, impacting confidentiality, integrity, and availability.

The weakness maps to CWE-284: Improper Access Control. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact
An unauthenticated attacker reachable over HTTP can take over PeopleSoft Enterprise PeopleTools, exposing enterprise HR, finance, and campus data systems to full compromise.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-10-20 - CVE-2026-101411 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-101411

Vulnerability Analysis

The vulnerability resides in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. Business Interlink historically provides a plugin framework for calling external services from PeopleCode. The flaw allows an unauthenticated attacker with HTTP access to the PeopleTools web tier to reach functionality that should be restricted.

Oracle categorizes the issue as difficult to exploit, reflected in the attack complexity rating. However, no authentication or user interaction is required. Successful exploitation yields high impact across confidentiality, integrity, and availability, consistent with full application takeover.

PeopleTools underpins Oracle PeopleSoft HCM, Financials, Campus Solutions, and Supply Chain applications. A compromise of PeopleTools therefore extends to all hosted PeopleSoft modules and the sensitive enterprise data they process.

Root Cause

The root cause is improper access control [CWE-284] in the Business Interlink component. Access decisions on affected endpoints fail to enforce authentication or authorization requirements, enabling unauthenticated callers to invoke privileged functionality. Oracle has not released detailed technical specifics beyond the advisory metadata.

Attack Vector

The attack vector is network-based over HTTP. An attacker reaches the PeopleTools web tier, typically the PeopleSoft Internet Architecture (PIA) servlet or related Business Interlink endpoints, and sends crafted requests. No credentials and no user interaction are required. The high attack complexity suggests specific conditions or request shaping are needed to reliably trigger the flaw.

No public proof-of-concept exploit has been published. See the Oracle Security Alert October 2026 for vendor-authoritative details.

Detection Methods for CVE-2026-101411

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Business Interlink URLs on PeopleSoft Internet Architecture (PIA) web servers from untrusted sources.
Unexpected outbound connections initiated by PeopleTools application servers to attacker-controlled hosts, which may indicate abuse of Business Interlink plugin behavior.
New or modified PeopleCode definitions, Integration Broker nodes, or administrative user accounts in the PeopleSoft database without a corresponding change request.
Web server access logs showing anomalous POST request bodies or long query strings targeting PeopleTools servlet paths.

Detection Strategies

Inventory all internet-exposed PeopleTools 8.61–8.63 instances and confirm whether the Business Interlink component is reachable from untrusted networks.
Enable verbose logging on the PIA web tier and WebLogic/Tuxedo application servers to capture full request URIs, source IPs, and response codes for Business Interlink paths.
Correlate web tier logs with application server logs to identify request patterns that succeed without prior authenticated session establishment.
Baseline normal Business Interlink usage patterns, then alert on access from unexpected source networks or at anomalous times.

Monitoring Recommendations

Forward PIA, WebLogic, Tuxedo, and database audit logs to a centralized SIEM or data lake for cross-source correlation.
Monitor PeopleSoft administrative tables (PSOPRDEFN, PSROLEUSER, PSAUTHITEM) for unauthorized changes to users, roles, and permission lists.
Alert on egress traffic from PeopleTools application servers to non-approved external destinations.
Track process creation and file writes on PeopleTools hosts, since application-level takeover frequently progresses to operating system command execution.

How to Mitigate CVE-2026-101411

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update for October 2026 to all PeopleTools 8.61, 8.62, and 8.63 deployments.
Restrict network access to PeopleTools web tiers so only trusted networks and corporate VPN ranges can reach Business Interlink endpoints.
Review web server and application logs retroactively for suspicious requests to Business Interlink paths dating back several months.
Rotate credentials, API keys, and integration secrets stored within PeopleSoft if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-101411 in the October 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert October 2026 for the exact patch bundle numbers, prerequisites, and application order for PeopleTools 8.61, 8.62, and 8.63. Oracle only supports fixes applied against currently supported PeopleTools releases.

Workarounds

Place a reverse proxy or web application firewall in front of PIA and block external access to Business Interlink URLs until patching completes.
Disable the Business Interlink component in environments that do not require it, following Oracle PeopleBooks guidance for the installed PeopleTools version.
Enforce IP allowlisting at the load balancer or firewall for all PeopleTools administrative and integration endpoints.
Require VPN or zero-trust network access for any administrative or integration traffic reaching PeopleSoft Internet Architecture.

bash

# Example: restrict access to PeopleTools PIA Business Interlink paths at an nginx reverse proxy
location ~* /psc/.*/BUSINESS_INTERLINK {
    allow 10.0.0.0/8;      # trusted internal integration network
    allow 192.168.50.0/24; # admin jump hosts
    deny all;
    proxy_pass https://peoplesoft-pia-backend;
}