CVE-2026-47051: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-47051 Overview

CVE-2026-47051 is an open redirect vulnerability [CWE-601] in the Security component of Oracle PeopleSoft Enterprise PeopleTools. Affected versions include 8.61 and 8.62. A low-privileged attacker with network access over HTTP can exploit this flaw, but successful attacks require user interaction from a victim other than the attacker. Because the vulnerability produces a scope change, exploitation may impact products beyond PeopleTools itself. Successful attacks can result in unauthorized read access to a subset of PeopleTools data and unauthorized update, insert, or delete access to a limited set of records.

Critical Impact
An attacker can trick authenticated PeopleSoft users into following crafted URLs that lead to attacker-controlled destinations, enabling credential theft, session abuse, and limited data modification across trust boundaries.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Security component of PeopleTools

Discovery Timeline

2026-07-21 - CVE-2026-47051 published to the National Vulnerability Database (NVD)
July 2026 - Oracle addresses the vulnerability in the Oracle Security Alert July 2026
2026-07-23 - Last updated in the NVD database

Technical Details for CVE-2026-47051

Vulnerability Analysis

The vulnerability is classified as a URL redirection to untrusted site, commonly known as an open redirect [CWE-601]. The PeopleTools Security component accepts a redirect target from user-controlled input and forwards the browser without validating that the destination belongs to a trusted domain.

Attackers can craft a link that begins with a legitimate PeopleSoft URL but redirects the victim to an attacker-controlled host. Because the initial hostname is trusted, users and email security tools are more likely to accept the link. Exploitation requires the victim to click a crafted URL, which aligns with the CVSS user interaction requirement.

The scope change reflects that the redirect crosses a trust boundary from PeopleTools into the target site of the attacker. That downstream site can harvest credentials, prompt for multi-factor codes, or serve malicious content that impacts additional Oracle or third-party applications integrated with PeopleSoft.

Root Cause

The root cause is insufficient validation of a redirect parameter processed by the Security component. The application uses the supplied value to construct an HTTP redirect response without enforcing an allowlist of internal hosts or stripping absolute URLs. Any authenticated user with low privileges can generate such a URL for distribution to victims.

Attack Vector

The attack vector is network-based over HTTP. An authenticated low-privileged attacker constructs a URL that references a valid PeopleSoft endpoint and includes a redirect parameter pointing to a domain they control. The attacker delivers the link through phishing email, chat, or embedded content. When a higher-privileged PeopleSoft user clicks the link, the application issues a redirect that lands the victim on the attacker's site, which can then impersonate PeopleSoft to solicit credentials or session tokens.

No verified public proof-of-concept code is available for CVE-2026-47051. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-47051

Indicators of Compromise

Outbound HTTP 302 responses from PeopleSoft servers whose Location header points to external domains not in the organization's allowlist.
Web server or reverse proxy logs containing redirect parameters with fully qualified URLs, encoded schemes such as %2F%2Fevil.example, or protocol-relative prefixes.
User reports of PeopleSoft login pages hosted on unfamiliar domains after clicking a link that began with a corporate PeopleSoft hostname.
Spikes in authentication failures on PeopleSoft accounts shortly after phishing campaigns targeting employees.

Detection Strategies

Inspect PeopleTools access logs for requests to Security component endpoints containing parameters that hold absolute URLs or encoded external hosts.
Correlate email gateway telemetry with web proxy logs to identify PeopleSoft links whose final destination differs from the initial hostname.
Deploy web application firewall rules that flag redirect parameters containing http://, https://, //, or their URL-encoded equivalents.

Monitoring Recommendations

Alert on any PeopleTools redirect response resolving to a domain outside the corporate trust zone.
Track user-agent and referer chains that traverse a PeopleSoft host and terminate at an unclassified external site.
Baseline redirect traffic during normal PeopleSoft workflows to make anomalous redirects easier to identify.

How to Mitigate CVE-2026-47051

Immediate Actions Required

Apply the patches from the Oracle Security Alert July 2026 to PeopleTools 8.61 and 8.62 deployments.
Notify PeopleSoft users about active phishing techniques that abuse trusted PeopleSoft URLs and reinforce reporting procedures.
Rotate credentials and session tokens for accounts that may have interacted with suspicious redirect links.

Patch Information

Oracle addressed CVE-2026-47051 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and validate the fix in a non-production environment before rolling it out enterprise-wide.

Workarounds

Configure the reverse proxy or web application firewall to strip or reject redirect parameters that contain absolute URLs or protocol-relative prefixes.
Enforce an allowlist of internal hostnames for any redirect functionality fronting PeopleTools.
Restrict outbound navigation from PeopleSoft session pages through browser isolation or SSO warning pages that require confirmation before leaving trusted domains.

bash

# Example WAF rule pattern (ModSecurity) to block external redirect targets
SecRule ARGS_NAMES "@rx (?i)(redirect|url|next|return|dest)" \
    "chain,phase:2,deny,status:400,id:1004701,msg:'CVE-2026-47051 open redirect attempt'"
    SecRule ARGS "@rx ^(https?:)?//" "t:none,t:urlDecodeUni"