CVE-2026-47049: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47049 Overview

CVE-2026-47049 is a medium-severity vulnerability affecting the Oracle PeopleSoft Enterprise PeopleTools product, specifically within the PIA (PeopleSoft Internet Architecture) Core Technology component. The flaw affects supported versions 8.61 and 8.62. An authenticated attacker with high privileges and network access via HTTP can exploit the weakness to gain unauthorized access to critical PeopleSoft data. The vulnerability is categorized under [CWE-284: Improper Access Control] and impacts confidentiality only, with no integrity or availability effects. Oracle disclosed this issue in its July 2026 Critical Patch Update advisory.

Critical Impact
Successful exploitation allows a high-privileged attacker to gain unauthorized access to all data accessible through PeopleSoft Enterprise PeopleTools, exposing sensitive enterprise information such as HR, financial, and supply chain records.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools version 8.61
Oracle PeopleSoft Enterprise PeopleTools version 8.62
PIA Core Technology component

Discovery Timeline

2026-07-21 - CVE-2026-47049 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47049

Vulnerability Analysis

The vulnerability resides in the PIA Core Technology component of PeopleSoft Enterprise PeopleTools. PIA is the web-based architecture that serves PeopleSoft applications over HTTP to end users. The flaw represents an improper access control condition [CWE-284] that allows a privileged user session to reach data resources it should not be able to read.

An attacker must already hold high privileges within the PeopleTools environment to trigger the issue. Once exploited, the flaw provides confidentiality-only impact, exposing all data accessible to PeopleSoft Enterprise PeopleTools. Integrity and availability of the system remain intact.

The vulnerability is easily exploitable over the network without user interaction. This raises the risk profile for organizations where administrative accounts are shared, insufficiently monitored, or compromised through credential theft.

Root Cause

The root cause is improper enforcement of access control checks inside the PIA Core Technology component. The component fails to properly restrict which data resources a privileged session can access, permitting horizontal or vertical reads of restricted data. Oracle has not published detailed technical root-cause information beyond the Oracle Security Alert July 2026.

Attack Vector

The attack vector is network-based via HTTP against the PeopleSoft Internet Architecture front end. The attacker authenticates with a high-privileged account and then issues crafted requests to PIA endpoints. Because no user interaction is required and attack complexity is low, exploitation can be scripted once credentials are obtained. No public proof-of-concept exploit is currently available.

Refer to the Oracle Security Alert July 2026 for vendor-specific technical details.

Detection Methods for CVE-2026-47049

Indicators of Compromise

Unusual data access patterns from privileged PeopleTools accounts, particularly bulk reads across modules the account does not normally touch.
HTTP requests to PIA endpoints originating from atypical source IPs or outside business hours.
Authentication events for administrative PeopleTools accounts from new or unrecognized user agents.

Detection Strategies

Enable and review PeopleSoft audit logs (PSACCESSLOG, signon audit, and component-level audits) for anomalous access by privileged users.
Correlate web server access logs for the PIA servlet with authentication events to identify privileged sessions performing large or unusual data reads.
Deploy behavioral analytics against PeopleSoft application traffic to identify deviations from a privileged user's baseline activity.

Monitoring Recommendations

Forward PeopleSoft application, web server, and database audit logs into a centralized SIEM for correlation and retention.
Alert on privilege elevation events and administrative role assignments within PeopleTools Security Administrator.
Continuously monitor the current EPSS score of 0.381% (percentile 30.6) as exploit likelihood may change over time.

How to Mitigate CVE-2026-47049

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all PeopleTools 8.61 and 8.62 instances as soon as change control permits.
Inventory all PeopleTools deployments and confirm which are running affected versions.
Review and reduce the number of accounts holding high-privilege PeopleTools roles.
Enforce multi-factor authentication (MFA) for all privileged PeopleSoft administrative accounts.

Patch Information

Oracle addressed CVE-2026-47049 in the July 2026 Critical Patch Update. Consult the Oracle Security Alert July 2026 for patch bundles, download instructions, and version-specific remediation guidance. Oracle recommends applying Critical Patch Updates promptly and does not typically provide standalone fixes outside of the CPU cycle.

Workarounds

Restrict network access to the PIA web tier so that only trusted management networks can reach administrative interfaces.
Implement strict least-privilege reviews for PeopleTools roles such as PeopleSoft Administrator and remove unnecessary high-privilege grants.
Increase audit logging verbosity for privileged user activity while the patch is scheduled for deployment.
Place a web application firewall (WAF) in front of the PIA endpoints and enforce rate limits on administrative URLs.

bash

# Configuration example: restrict access to the PIA admin interface at the reverse proxy
# Only allow the trusted admin subnet to reach /psp/ and /psc/ URIs
location ~ ^/(psp|psc)/ {
    allow 10.10.20.0/24;   # trusted admin network
    deny  all;
    proxy_pass http://peoplesoft_pia_backend;
}