CVE-2026-21951: Oracle PeopleSoft Auth Bypass Vulnerability

CVE-2026-21951 Overview

CVE-2026-21951 is a cross-site scripting (XSS) vulnerability [CWE-79] in the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.60, 8.61, and 8.62. An unauthenticated attacker with network access via HTTP can exploit the vulnerability when a victim user interacts with a crafted request. Successful exploitation results in unauthorized read, insert, update, or delete access to a subset of PeopleSoft Enterprise PeopleTools data. The vulnerability carries a scope change, meaning exploitation may significantly impact additional products beyond PeopleTools itself. Oracle addressed the issue in the January 2026 Critical Patch Update.

Critical Impact
An unauthenticated network attacker can compromise integrity and confidentiality of PeopleTools-accessible data, with a scope change that extends impact to additional products when a user is tricked into interacting with a crafted request.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.60
Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62

Discovery Timeline

2026-01-20 - Oracle disclosed the vulnerability in the January 2026 Critical Patch Update
2026-01-20 - CVE-2026-21951 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-21951

Vulnerability Analysis

The vulnerability resides in the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools. Integration Broker handles asynchronous and synchronous messaging between PeopleSoft applications and external systems over HTTP. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation), indicating a cross-site scripting condition. An attacker can craft a malicious HTTP request or link containing script payloads that the application renders without proper neutralization. When a victim user interacts with the crafted content, the injected script executes in the user's browser within the trust context of the PeopleSoft application.

Root Cause

The Integration Broker component fails to properly sanitize or encode user-supplied input before reflecting it into web responses. This allows attacker-controlled content to be interpreted as executable script by the victim's browser. The scope change in the CVSS vector indicates the script can affect resources beyond the originally vulnerable component.

Attack Vector

Exploitation requires network access over HTTP and human interaction from a user other than the attacker. A typical scenario involves an attacker delivering a crafted URL or message through phishing, instant messaging, or a malicious third-party site. When the victim clicks the link or loads the page while authenticated to PeopleSoft, the injected script runs with the victim's privileges. The attacker can then perform unauthorized read, insert, update, or delete operations against a subset of PeopleTools data. No authentication is required from the attacker because the script executes in the authenticated victim's session.

No public proof-of-concept code is available for this vulnerability. Refer to the Oracle Critical Patch Update January 2026 advisory for vendor-supplied details.

Detection Methods for CVE-2026-21951

Indicators of Compromise

HTTP requests to Integration Broker endpoints containing script tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
Unexpected outbound HTTP requests from PeopleSoft user sessions to attacker-controlled domains, indicative of stolen session data or cookies
Anomalous data modifications in PeopleTools records performed under legitimate user accounts that did not originate from normal application workflows

Detection Strategies

Inspect web server and application logs for Integration Broker URLs containing URL-encoded or raw HTML, JavaScript payloads, or reflected query parameters
Deploy a web application firewall (WAF) rule set that flags reflected XSS patterns against /PSIGW/ and related Integration Broker paths
Correlate user-agent, referer, and authentication session telemetry to identify users following externally referred links that immediately trigger sensitive PeopleSoft transactions

Monitoring Recommendations

Forward PeopleSoft web tier, application server, and Integration Broker logs to a centralized SIEM for retention and correlation
Alert on outbound connections from browsers immediately following authenticated PeopleSoft sessions, particularly to newly registered or low-reputation domains
Monitor for spikes in CRUD operations against PeopleTools data initiated through Integration Broker endpoints outside of scheduled integrations

How to Mitigate CVE-2026-21951

Immediate Actions Required

Apply the January 2026 Oracle Critical Patch Update to PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 without delay
Review Integration Broker node and service configurations for unnecessary exposure, and restrict inbound HTTP access to trusted networks where feasible
Educate PeopleSoft users to avoid clicking unsolicited links referencing PeopleSoft URLs, particularly those received through email or external messaging

Patch Information

Oracle released fixes for this vulnerability in the Oracle Critical Patch Update January 2026. Administrators should review the advisory matrix for the appropriate patch identifier corresponding to their PeopleTools version and apply it according to Oracle's patching procedures.

Workarounds

Place a web application firewall in front of PeopleSoft web servers and enable reflected XSS and HTML injection rule sets covering Integration Broker paths
Enforce strict Content Security Policy (CSP) headers on the PeopleSoft web tier to limit inline script execution and restrict allowed script sources
Restrict Integration Broker gateway endpoints to authenticated internal consumers using network segmentation and reverse proxy access controls until patches are applied

bash

# Example NGINX reverse proxy configuration adding a restrictive CSP
# header in front of the PeopleSoft web tier
location /PSIGW/ {
    proxy_pass http://peoplesoft-backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}