CVE-2026-101450: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-101450 Overview

CVE-2026-101450 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise PeopleTools product, specifically within the Integration Broker component. Supported versions 8.61 through 8.63 are affected. The flaw allows an unauthenticated remote attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools when a victim user is tricked into performing an action. Successful exploitation can result in unauthorized access to all PeopleTools-accessible data and unauthorized update, insert, or delete access to a subset of that data. Oracle disclosed the vulnerability in the October 2026 Critical Patch Update.

Critical Impact

Successful exploitation yields complete read access to PeopleSoft Enterprise PeopleTools data and partial write access, enabling data theft and tampering across integrated business processes.

Affected Products

• Oracle PeopleSoft Enterprise PeopleTools 8.61
• Oracle PeopleSoft Enterprise PeopleTools 8.62
• Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

• 2026-10-20 - CVE-2026-101450 published to NVD
• 2026-10-21 - Last updated in NVD database
• October 2026 - Addressed in the Oracle Critical Patch Update Advisory - October 2026

Technical Details for CVE-2026-101450

Vulnerability Analysis

The vulnerability resides in the Integration Broker component of PeopleSoft Enterprise PeopleTools. Integration Broker is the middleware layer that handles asynchronous and synchronous messaging between PeopleSoft applications and external systems over HTTP. The weakness is reachable over the network without prior authentication, but requires human interaction from a user other than the attacker. This pattern is consistent with a user-interaction-triggered flaw such as a reflected injection or request-forgery condition exposed by Integration Broker endpoints.

Exploitation grants an attacker read access to data accessible through the targeted PeopleTools instance, along with limited write capability. Because Integration Broker brokers messages across HR, Financials, and Campus Solutions modules, the blast radius extends to data processed by downstream integrations. Oracle has not released public technical specifics beyond the October 2026 Security Alert.

Root Cause

Oracle has not disclosed the root cause of CVE-2026-101450. The CVSS vector indicates the entry point is HTTP, the attack complexity is low, no privileges are required, and user interaction is required. These attributes point to a client-assisted attack path reachable through Integration Broker HTTP handlers.

Attack Vector

An unauthenticated attacker crafts a malicious HTTP request or link that targets an Integration Broker endpoint. A legitimate PeopleTools user must interact with the attacker-supplied content, typically by visiting a crafted URL while holding an active session. The attacker then abuses the user's context to read sensitive data and perform a limited set of write operations. No authentication to the PeopleSoft instance is required by the attacker.

Technical specifics are not public. See the Oracle Security Alert - October 2026 for vendor guidance.

Detection Methods for CVE-2026-101450

Indicators of Compromise

• Unexpected HTTP requests to Integration Broker service endpoints (for example, paths containing /PSIGW/ or IntegrationBroker) originating from external referrers
• Integration Broker transaction logs showing message publication or subscription activity tied to user sessions that did not initiate the operation
• Anomalous outbound Integration Broker messages to unknown nodes or endpoints

Detection Strategies

• Inspect PeopleTools web server access logs for Integration Broker URLs invoked with suspicious query strings or unusual referer headers
• Correlate authenticated user session identifiers with Integration Broker message activity to detect actions that users did not initiate
• Alert on changes to Integration Broker nodes, routings, and service operation security that occur outside change windows

Monitoring Recommendations

• Enable verbose logging on the Integration Broker gateway (integrationGateway.properties) and forward logs to a centralized analytics platform
• Monitor the PSIBPUBXDATA, PSIBSUBXDATA, and related messaging tables for unexpected inserts or updates
• Track Integration Broker administrative pages for configuration changes and new service operation permissions

How to Mitigate CVE-2026-101450

Immediate Actions Required

• Apply the October 2026 Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools to any instance running 8.61, 8.62, or 8.63
• Inventory all internet-facing PeopleTools deployments and prioritize those exposing Integration Broker over HTTP
• Review Integration Broker message and transaction logs for suspicious activity dating back to the publication window

Patch Information

Oracle addressed CVE-2026-101450 in the October 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory - October 2026 for the applicable patch bundle and installation instructions for PeopleTools 8.61 through 8.63.

Workarounds

• Restrict external network access to Integration Broker endpoints using a reverse proxy or web application firewall allowlist
• Enforce short web session timeouts in PeopleTools to limit the window in which a user's authenticated session can be abused
• Educate PeopleSoft users to avoid clicking unsolicited links referencing PeopleSoft or Integration Broker URLs until patching is complete