CVE-2026-70861: PeopleSoft Enterprise Privilege Escalation

CVE-2026-70861 Overview

CVE-2026-70861 is a high-severity access control vulnerability in the Oracle PeopleSoft Enterprise FIN Common Objects Brazil product, specifically within the Common Objects component. The affected supported release is version 9.1. An attacker with high privileges and network access via the T3 or IIOP protocols can exploit the flaw to fully compromise the affected product. Successful exploitation results in a complete takeover of PeopleSoft Enterprise FIN Common Objects Brazil, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in its August 2026 security alert cycle.

Critical Impact
Successful exploitation results in full takeover of PeopleSoft Enterprise FIN Common Objects Brazil with high impact to confidentiality, integrity, and availability.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1
Component: Common Objects
Exposed protocols: T3 and IIOP

Discovery Timeline

2026-08-18 - CVE-2026-70861 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-70861

Vulnerability Analysis

The vulnerability is categorized under CWE-284: Improper Access Control. It affects the Common Objects component of PeopleSoft Enterprise FIN Common Objects Brazil 9.1. Oracle's advisory indicates that the flaw is easily exploitable, but requires the attacker to already possess high privileges within the environment. The attack surface is exposed through the T3 and Internet Inter-ORB Protocol (IIOP) network protocols used by the underlying application server. Successful attacks lead to takeover of the affected product with high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is improper access control within the Common Objects component. The component does not adequately restrict privileged operations exposed through T3 and IIOP interfaces, allowing an authenticated high-privilege actor to reach code paths that should be constrained. Oracle has not published detailed technical internals of the flaw beyond the advisory metadata.

Attack Vector

The attack vector is network-based. An attacker requires network reachability to the T3 or IIOP listener on the PeopleSoft application server and must already hold high-level privileges. From that position, the attacker issues protocol-level requests that abuse the access control gap to escalate control over the target product. No user interaction is required. Refer to the Oracle Security Alert for authoritative details.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no sanitized proof-of-concept has been released by Oracle or third parties.

Detection Methods for CVE-2026-70861

Indicators of Compromise

Unexpected T3 or IIOP connections to PeopleSoft application servers originating from non-administrative subnets or unusual client hosts.
Privileged account activity from PeopleSoft service or administrative accounts occurring outside of normal change windows.
Anomalous configuration changes, new user provisioning, or object modifications within Common Objects for the Brazil FIN module.

Detection Strategies

Enable and centrally collect WebLogic and PeopleSoft application server audit logs, focusing on T3/IIOP session establishment and administrative operations.
Baseline legitimate administrator behavior and alert on deviations such as new source IPs, off-hours access, or bursts of privileged calls.
Correlate PeopleSoft privileged actions with identity provider events to detect misuse of high-privilege accounts.

Monitoring Recommendations

Monitor network flows to T3 (default 7001/7002) and IIOP listener ports for connections from unauthorized segments.
Track failed and successful authentications against PeopleSoft administrative roles and forward events to a SIEM or data lake for correlation.
Alert on modifications to Common Objects configuration and on any changes to security definitions for the FIN Brazil module.

How to Mitigate CVE-2026-70861

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update / Security Alert of August 2026 to all affected PeopleSoft 9.1 deployments.
Restrict network access to T3 and IIOP listeners to trusted management networks only, using firewall rules or a jump host.
Audit and reduce the number of accounts holding high privileges within PeopleSoft FIN Common Objects Brazil.

Patch Information

Oracle addresses this vulnerability in the August 2026 security alert bundle. Administrators should identify the applicable PeopleSoft patch set or bug fix listed in the advisory and schedule deployment on all instances running FIN Common Objects Brazil 9.1. Validate the patch in a staging environment prior to production rollout and confirm that Common Objects functions operate as expected after applying updates.

Workarounds

Block external and untrusted internal access to T3 and IIOP ports at the network perimeter until patches are applied.
Enforce strong authentication and session controls on PeopleSoft administrative accounts, including multi-factor authentication where supported.
Use WebLogic connection filters to restrict T3/IIOP client hosts to a known allowlist of administrative workstations or bastion hosts.

bash

# Example WebLogic connection filter to restrict T3/IIOP to a management subnet
# Configure in the WebLogic Administration Console under:
#   Domain > Security > Filter > Connection Filter Rules
# Filter class: weblogic.security.net.ConnectionFilterImpl
10.20.30.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops