CVE-2026-47024: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47024 Overview

CVE-2026-47024 is a vulnerability in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools version 8.62. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation requires user interaction from a person other than the attacker. The vulnerability produces a scope change, meaning attacks may impact products beyond PeopleTools itself. Successful attacks can result in unauthorized update, insert, or delete operations against a subset of accessible data, as well as unauthorized read access to a subset of that data. The underlying weakness is classified as improper access control [CWE-284].

Critical Impact
Authenticated attackers can trigger unauthorized read and write access to PeopleSoft data through a user-interaction-driven HTTP attack that crosses security scopes.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.62
Component: Panel Processor
Deployments exposing PeopleTools HTTP interfaces to low-privileged users

Discovery Timeline

2026-07-21 - CVE-2026-47024 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-47024

Vulnerability Analysis

The vulnerability resides in the Panel Processor component of PeopleSoft Enterprise PeopleTools 8.62. The Panel Processor handles rendering and processing of user-facing PeopleSoft panels served over HTTP. Improper access control [CWE-284] in this component allows a low-privileged authenticated user to influence actions performed by another user session. The scope change indicated in the vector shows that the impact reaches components outside the vulnerable module's security boundary. Both confidentiality and integrity are affected at a limited level, while availability is not impacted. Because the attack requires human interaction, exploitation aligns with vectors such as crafted links or embedded content that a victim must access while authenticated.

Root Cause

The root cause is improper enforcement of access control [CWE-284] within the Panel Processor. Requests processed by the component do not adequately validate authorization boundaries between the requesting principal and the resources or actions being invoked. Oracle has not publicly released source-level details beyond the Critical Patch Update advisory.

Attack Vector

An attacker authenticates to PeopleSoft with low privileges and issues HTTP requests to the vulnerable Panel Processor. The attacker then induces a second, higher-context user to interact with attacker-influenced content, causing the victim's session to execute the unauthorized operation. Because the attack crosses scopes, downstream PeopleSoft data and dependent products may be affected. No public proof-of-concept exploit has been published for this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.162% (percentile 5.776) as of 2026-07-23.

// No verified public exploit code is available for CVE-2026-47024.
// See the Oracle Critical Patch Update Advisory - July 2026 for vendor details.

Detection Methods for CVE-2026-47024

Indicators of Compromise

Unexpected HTTP requests to PeopleTools Panel Processor endpoints originating from low-privileged accounts
PeopleSoft audit records showing unauthorized insert, update, or delete operations tied to sessions that received externally referred requests
Anomalous cross-referrer navigation into PeopleTools pages from external domains or user-supplied links

Detection Strategies

Correlate PeopleSoft application server access logs with authentication logs to identify low-privileged users generating requests that trigger data modification for other sessions
Alert on HTTP requests to Panel Processor URLs containing unusual parameters or referrers from outside the trusted PeopleSoft domain
Compare data modification audit trails against expected role permissions to surface scope-crossing changes

Monitoring Recommendations

Enable verbose auditing on PeopleTools tables that store business-critical records and forward logs to a centralized SIEM
Monitor web application firewall (WAF) telemetry for anomalous POST activity against /psp/ and /psc/ PeopleSoft servlet paths
Track failed and successful authorization checks in PeopleTools security logs to identify probing behavior

How to Mitigate CVE-2026-47024

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update Advisory - July 2026 to all PeopleTools 8.62 deployments
Inventory PeopleSoft environments and confirm patch level of every PeopleTools instance exposed over HTTP or HTTPS
Restrict PeopleTools administrative and panel endpoints to authenticated internal networks where feasible

Patch Information

Oracle addressed CVE-2026-47024 in the July 2026 Critical Patch Update. Administrators must apply the PeopleTools patch bundle published by Oracle for version 8.62. Refer to the Oracle Security Alert July 2026 for exact patch identifiers, prerequisites, and installation guidance.

Workarounds

Enforce least-privilege role assignments so that low-privileged users cannot reach the Panel Processor when not required for their function
Deploy WAF rules that inspect and validate referrers and parameters submitted to PeopleTools panel URLs
Require re-authentication or additional verification for state-changing PeopleSoft operations to reduce the impact of user-interaction-triggered attacks

bash

# Example WAF rule (ModSecurity-style) to restrict cross-origin POSTs to PeopleTools panels
SecRule REQUEST_METHOD "@streq POST" \
    "id:1004702401,phase:1,deny,status:403,\
    chain,msg:'Block cross-origin POST to PeopleTools Panel Processor'"
    SecRule REQUEST_URI "@beginsWith /psp/" \
        "chain"
        SecRule REQUEST_HEADERS:Referer "!@beginsWith https://peoplesoft.internal.example.com/"