CVE-2026-47026: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47026 Overview

CVE-2026-47026 is an open redirect vulnerability [CWE-601] affecting the OpenSearch Dashboards component of Oracle PeopleSoft Enterprise PeopleTools. Supported versions 8.61 and 8.62 are affected. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful attacks require user interaction. The vulnerability carries a scope change, meaning exploitation can impact resources beyond PeopleTools itself. Successful exploitation results in unauthorized access to critical data or complete access to all PeopleTools accessible data.

Critical Impact
A remote unauthenticated attacker can trick users into visiting attacker-controlled destinations through a trusted PeopleSoft URL, exposing confidential PeopleTools data across a broader trust boundary.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
OpenSearch Dashboards component embedded in PeopleTools

Discovery Timeline

2026-07-21 - CVE CVE-2026-47026 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47026

Vulnerability Analysis

The vulnerability resides in the OpenSearch Dashboards component bundled with PeopleSoft Enterprise PeopleTools. OpenSearch Dashboards is the visualization frontend used by PeopleTools for search analytics and log exploration. The flaw is classified as an open redirect under [CWE-601], where the application accepts a URL or similar destination parameter from user input and uses it to construct navigation without sufficient validation.

Exploitation is network-based over HTTP and requires no authentication. A user must interact with an attacker-supplied link. Because the scope changes on exploitation, the compromised trust extends beyond PeopleTools into adjacent systems, credentials, or session material that the victim can access. Confidentiality is fully impacted while integrity and availability are not directly affected.

Root Cause

OpenSearch Dashboards accepts a redirect target parameter and forwards the browser to that destination without adequately validating that the target belongs to the trusted PeopleSoft origin. Attackers craft URLs where the legitimate PeopleSoft host prefixes a malicious destination, allowing the server or client-side redirect logic to send authenticated users to an attacker-controlled host that harvests session tokens, OAuth codes, or credentials.

Attack Vector

An attacker crafts a link to a legitimate PeopleTools OpenSearch Dashboards endpoint containing a malicious redirect parameter. The link is delivered by phishing, chat, or embedded on a third-party site. When a PeopleSoft user with an active session clicks the link, the application redirects the browser to the attacker-controlled site. The attacker's page can mimic the PeopleSoft login screen, request re-authentication, or capture query-string credentials and tokens leaked through the Referer header. Because the redirect originates from a trusted PeopleSoft domain, users and security controls are more likely to trust the destination.

No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-47026

Indicators of Compromise

Outbound HTTP redirects from PeopleSoft OpenSearch Dashboards endpoints pointing to non-corporate hostnames or IP literals.
Web server access logs containing suspicious redirect query parameters such as redirect=, next=, url=, or nextUrl= with absolute external URLs.
Spikes in HTTP 3xx responses from OpenSearch Dashboards paths correlated with inbound clicks from email or messaging platforms.
User reports of unexpected re-authentication prompts after clicking PeopleSoft links.

Detection Strategies

Inspect reverse proxy and web application firewall logs for OpenSearch Dashboards requests whose redirect parameters resolve to hosts outside the approved allow list.
Deploy URL parameter inspection rules that flag encoded, protocol-relative, or backslash-obfuscated targets (for example //evil.tld, \\evil.tld, %2f%2fevil.tld).
Correlate email gateway URL rewriting telemetry with PeopleSoft hostnames to identify phishing campaigns weaponizing the vulnerability.

Monitoring Recommendations

Ingest PeopleSoft web tier, OpenSearch Dashboards, and identity provider logs into a centralized analytics platform for cross-source correlation.
Alert on authenticated PeopleSoft sessions immediately followed by external domain visits carrying session identifiers in Referer headers.
Track user-agent and geolocation anomalies for accounts that clicked flagged links, indicating potential session or credential replay.

How to Mitigate CVE-2026-47026

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 as documented in the Oracle Security Alert July 2026.
Inventory all internet-exposed PeopleTools deployments and prioritize patching for systems accessible outside the corporate network.
Notify users of active phishing risk and instruct them to report unexpected PeopleSoft redirect behavior.

Patch Information

Oracle addresses CVE-2026-47026 in the July 2026 Critical Patch Update. Administrators must apply the PeopleTools patch corresponding to their installed version (8.61 or 8.62). No configuration-only fix is provided by the vendor.

Workarounds

Restrict access to PeopleSoft OpenSearch Dashboards endpoints to authenticated corporate networks or VPN clients until patching is complete.
Enforce a strict outbound redirect allow list at the reverse proxy or WAF layer, rejecting requests whose redirect targets resolve outside approved domains.
Enable HTTP Referrer-Policy: strict-origin-when-cross-origin and short-lived session cookies to reduce token leakage during a successful redirect.
Deliver security awareness reminders warning users about link inspection even when the domain appears legitimate.

bash

# Example WAF rule: block external absolute URLs in redirect parameters
# (adapt to your WAF syntax; illustrative ModSecurity example)
SecRule ARGS_NAMES "@rx (?i)^(redirect|next|url|nextUrl|returnTo)$" \
  "chain,phase:2,deny,status:400,id:1026047026,\
   msg:'Blocked potential open redirect (CVE-2026-47026)'"
  SecRule ARGS "@rx ^(https?:)?//(?!peoplesoft\.example\.com)" \
    "t:none,t:urlDecodeUni,t:lowercase"