CVE-2026-47048: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47048 Overview

CVE-2026-47048 is an open redirect vulnerability [CWE-601] in the Security component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.61 and 8.62. A low-privileged attacker with network access over HTTP can exploit the issue, but successful attacks require user interaction from a victim other than the attacker. Because the vulnerability produces a scope change, exploitation may impact products beyond PeopleTools itself. Successful attacks can result in unauthorized create, update, or delete operations on a subset of PeopleTools-accessible data, along with limited unauthorized read access.

Critical Impact
Exploitation can redirect authenticated PeopleSoft users to attacker-controlled destinations, enabling credential theft and unauthorized modification of PeopleTools data across trust boundaries.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Security component of PeopleSoft Enterprise PeopleTools

Discovery Timeline

2026-07-21 - CVE-2026-47048 published to NVD as part of the Oracle July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47048

Vulnerability Analysis

The vulnerability resides in the Security component of PeopleSoft Enterprise PeopleTools. Classified as [CWE-601] URL Redirection to Untrusted Site, the flaw allows an attacker to craft a request that causes the application to redirect a user to an attacker-controlled URL. The scope change indicates that successful exploitation affects resources beyond the vulnerable component itself. Attackers commonly abuse open redirects to bolster phishing campaigns, bypass URL allowlists, and steal session artifacts after user interaction.

The attack requires the attacker to hold a low-privileged PeopleTools account and to trick another user, typically a higher-privileged one, into clicking the crafted link. The subsequent redirect can chain into credential harvesting or session-based follow-on attacks against PeopleSoft data.

Root Cause

The underlying defect is insufficient validation of user-controllable URL parameters used by the Security component to construct redirect responses. When the application accepts an external destination without enforcing a strict allowlist of internal targets, an attacker can substitute a hostile domain. The application then issues an HTTP redirect that browsers follow automatically, transferring the user's trust context to the attacker's site.

Attack Vector

An attacker with a valid low-privileged PeopleSoft account crafts a URL to a legitimate PeopleTools endpoint that embeds an attacker-controlled redirect target. The attacker delivers the URL through email, chat, or another social channel to a targeted PeopleSoft user. The victim, seeing a legitimate PeopleSoft hostname, follows the link. PeopleTools then redirects the browser to the attacker's site, which can impersonate a PeopleSoft login prompt, request re-authentication, or deliver malicious content. Captured credentials or tokens can then be used to perform unauthorized reads or modifications against PeopleTools data.

No verified public exploit code is available for CVE-2026-47048. Consult the Oracle July 2026 Security Alert for authoritative technical details.

Detection Methods for CVE-2026-47048

Indicators of Compromise

HTTP requests to PeopleTools Security endpoints containing external hostnames in redirect-related query parameters such as url, redirect, returnurl, or next.
PeopleSoft web server access logs showing 302 or 301 responses whose Location header points to domains outside the organization.
Referer chains where users arrive at credential prompts from a PeopleSoft URL but land on an unrelated domain.
Spikes in authentication failures shortly after users click PeopleSoft-hosted links delivered via email.

Detection Strategies

Parse PeopleSoft web tier logs for redirect parameters that decode to fully qualified external URLs and alert on any hostname outside a maintained allowlist.
Correlate web proxy telemetry with PeopleSoft session activity to flag users transitioning from PeopleTools URLs to newly registered or low-reputation domains.
Deploy phishing-aware email content inspection that expands and evaluates links pointing to PeopleTools Security endpoints with embedded redirect parameters.

Monitoring Recommendations

Enable verbose logging on the PeopleSoft web server and forward Location header values to a centralized analytics platform.
Establish a baseline of legitimate redirect destinations used by internal PeopleTools workflows and alert on deviations.
Monitor for anomalous data modification events in PeopleTools tied to user sessions that recently followed external redirects.

How to Mitigate CVE-2026-47048

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all PeopleTools 8.61 and 8.62 deployments.
Inventory internet-exposed PeopleSoft portals and prioritize patching those with external reachability first.
Brief PeopleSoft users on the phishing risk associated with links that appear to originate from legitimate PeopleTools hostnames.

Patch Information

Oracle released the corrective patch for CVE-2026-47048 as part of the July 2026 Critical Patch Update. Administrators should download the applicable PeopleTools patch bundle for versions 8.61 and 8.62 from My Oracle Support and follow the standard PeopleTools patch application procedure. Refer to the Oracle July 2026 Security Alert for the authoritative advisory and patch identifiers.

Workarounds

Configure the reverse proxy or web application firewall in front of PeopleSoft to strip or normalize redirect parameters containing external hostnames.
Enforce a strict allowlist of internal redirect targets at the web tier until patches are deployed.
Require re-authentication for sensitive PeopleTools transactions to limit the value of any stolen session artifacts.
Restrict low-privileged account creation and review existing accounts for unexpected access to Security component functionality.

bash

# Example WAF rule concept to block external redirects on PeopleTools endpoints
# Adapt to your specific WAF syntax before deployment
SecRule REQUEST_URI "@contains /psp/" \
  "chain,deny,status:403,id:1004701,msg:'PeopleTools external redirect blocked (CVE-2026-47048)'"
  SecRule ARGS:url|ARGS:redirect|ARGS:returnurl|ARGS:next \
    "@rx ^(https?:)?//(?!(intranet\\.example\\.com|peoplesoft\\.example\\.com))"