CVE-2026-47015: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47015 Overview

CVE-2026-47015 is an open redirect vulnerability [CWE-601] in the PIA Core Technology component of Oracle PeopleSoft Enterprise PeopleTools version 8.62. An unauthenticated attacker with network access via HTTP can exploit this flaw when a victim interacts with a crafted link. Successful exploitation impacts confidentiality, integrity, and availability, and can extend beyond PeopleTools to other integrated products due to scope change.

Critical Impact
Attackers can achieve unauthorized read, insert, update, or delete access to PeopleSoft data and cause a partial denial of service, with cross-product impact due to the scope change condition.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.62
PIA (PeopleSoft Internet Architecture) Core Technology component
Downstream products integrated with PeopleSoft Enterprise PeopleTools

Discovery Timeline

2026-07-21 - CVE CVE-2026-47015 published to NVD
2026-07-23 - Last updated in NVD database
Vendor advisory published in the Oracle Security Alert July 2026

Technical Details for CVE-2026-47015

Vulnerability Analysis

The vulnerability resides in the PIA Core Technology component of PeopleSoft Enterprise PeopleTools 8.62. The weakness is classified as an URL Redirection to Untrusted Site, commonly known as an open redirect [CWE-601]. The application accepts user-controlled input that specifies a redirect destination without adequately validating that the target belongs to a trusted domain.

An attacker delivers a crafted URL pointing to a legitimate PeopleSoft host. When a user clicks the link, the server or client-side handler redirects the browser to an attacker-controlled destination. Because the initial URL originates from a trusted PeopleSoft domain, victims are more likely to trust the resulting page.

The scope change indicator means exploitation impacts components beyond the vulnerable PeopleTools instance. Attackers can chain the redirect with phishing pages, credential harvesting forms, or malicious payload delivery targeting downstream systems.

Root Cause

The PIA Core Technology component fails to validate or restrict the destination of redirect parameters against an allowlist of trusted hosts. User-supplied input flows into a redirect response without normalization checks that would reject external URLs.

Attack Vector

The attack vector is network-based over HTTP and requires user interaction. An attacker crafts a URL that references a legitimate PeopleSoft endpoint but includes a redirect parameter pointing to an attacker-controlled site. The victim receives the link through phishing, chat, or social engineering, and clicking it triggers the redirect chain.

The vulnerability manifests when the PIA handler processes redirect parameters without host validation. Refer to the Oracle Security Alert July 2026 for the vendor's technical description.

Detection Methods for CVE-2026-47015

Indicators of Compromise

HTTP requests to PeopleSoft PIA endpoints containing redirect, url, next, or return parameters with fully qualified external URLs
Referrer headers on external domains that trace back to legitimate PeopleSoft hosts
Web proxy logs showing users transitioning from PeopleSoft domains to unrelated third-party sites within a single session
Phishing reports referencing PeopleSoft-branded links that terminate on non-corporate infrastructure

Detection Strategies

Deploy web application firewall (WAF) rules that inspect redirect parameters on PIA endpoints and flag values containing external hostnames, protocol handlers, or encoded schemes
Correlate email gateway telemetry with web proxy logs to identify inbound messages containing PeopleSoft URLs with suspicious redirect parameters
Baseline normal outbound redirect targets from PeopleSoft applications and alert on deviations to newly registered or low-reputation domains

Monitoring Recommendations

Enable verbose HTTP access logging on PeopleSoft PIA servers and forward logs to a centralized analytics platform
Monitor authentication events immediately following PIA redirect activity for credential replay indicators
Track user-reported phishing submissions referencing internal PeopleSoft URLs and pivot on the shared redirect parameters

How to Mitigate CVE-2026-47015

Immediate Actions Required

Apply the Oracle Critical Patch Update from the Oracle Security Alert July 2026 to all PeopleSoft Enterprise PeopleTools 8.62 instances
Inventory all internet-exposed PIA endpoints and prioritize patching on externally reachable systems
Notify users of active phishing risk leveraging PeopleSoft-branded links until patching completes

Patch Information

Oracle addressed CVE-2026-47015 in the July 2026 Critical Patch Update. Administrators must download and apply the PeopleTools patch bundle from My Oracle Support. Verify version strings after patching to confirm the fix is present. Consult the Oracle Security Alert July 2026 for exact patch identifiers.

Workarounds

Configure reverse proxy or WAF rules to strip or validate redirect parameters on PIA URLs before requests reach the application server
Enforce an allowlist of trusted internal hostnames for any redirect destination processed by PeopleSoft
Deploy egress URL rewriting in email security gateways to neutralize suspicious redirect parameters in inbound messages
Educate users to inspect the final destination of PeopleSoft links and report unexpected external redirects

bash

# Example WAF rule concept for blocking external redirects on PIA endpoints
# Reject requests where redirect-style parameters reference external schemes or hosts
SecRule ARGS_NAMES "@rx (?i)(redirect|url|next|return|dest|target)" \
  "chain,deny,status:403,id:1004715,msg:'Potential CVE-2026-47015 open redirect'"
  SecRule ARGS "@rx ^(https?:)?//([^/]*\.)?(?!trusted-peoplesoft\.example\.com)"