CVE-2026-70861: Oracle PeopleSoft Privilege Escalation

CVE-2026-70861 Overview

CVE-2026-70861 is a high-severity access control vulnerability in the Oracle PeopleSoft Enterprise FIN Common Objects Brazil product. The flaw resides in the Common Objects component of PeopleSoft version 9.1. An authenticated attacker with high privileges can exploit this issue over the network using the T3 or Internet Inter-ORB Protocol (IIOP) protocols. Successful exploitation results in full compromise of the affected PeopleSoft component, impacting confidentiality, integrity, and availability. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Successful attacks can result in complete takeover of PeopleSoft Enterprise FIN Common Objects Brazil, exposing sensitive financial data and enabling manipulation of business-critical records.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
Common Objects component
Deployments exposing T3 or IIOP protocol endpoints

Discovery Timeline

2026-08-18 - CVE-2026-70861 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70861

Vulnerability Analysis

The vulnerability affects the Common Objects component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1. The issue is exposed through the T3 and IIOP remote invocation protocols used by the underlying Oracle WebLogic and Tuxedo middleware layers. A remote attacker holding high-privileged credentials can invoke functionality that should be restricted, leading to takeover of the component. The impact spans all three security properties: confidentiality, integrity, and availability. Because PeopleSoft FIN modules handle financial records, a successful compromise can expose ledger data, vendor records, and tax-relevant Brazilian localization data.

Root Cause

The root cause is improper access control ([CWE-284]) within the Common Objects component. The application does not sufficiently restrict privileged operations exposed via T3 and IIOP remote method invocation. Authenticated users retain the ability to reach functionality that should require additional authorization boundaries.

Attack Vector

The attack requires network access to the T3 or IIOP listener ports on the PeopleSoft application server. The attacker must already possess high-privileged credentials, which limits opportunistic exploitation but does not rule out abuse by malicious insiders or attackers who have chained a prior credential compromise. No user interaction is required, and the attack complexity is low.

No public exploit code or proof-of-concept has been published. See the Oracle Security Alert August 2026 advisory for authoritative technical guidance.

Detection Methods for CVE-2026-70861

Indicators of Compromise

Unexpected T3 or IIOP connections to PeopleSoft application server ports from non-administrative subnets
Authentication events for high-privileged PeopleSoft accounts followed by unusual Common Objects component invocations
New or modified financial configuration records in FIN Common Objects Brazil without matching change-management tickets

Detection Strategies

Enable and forward Oracle WebLogic and PeopleSoft application server audit logs to a central analytics platform for correlation of privileged actions
Baseline legitimate administrative use of T3/IIOP protocols and alert on deviations, including off-hours activity or new source hosts
Monitor privileged PeopleSoft accounts for unusual session patterns, concurrent logins, or geolocation anomalies

Monitoring Recommendations

Continuously ingest PeopleSoft, WebLogic, and Tuxedo logs for anomaly detection across administrative operations
Alert on any external network flows reaching T3 (default 7001) or IIOP listener ports
Track configuration changes to Common Objects records and reconcile against approved change windows

How to Mitigate CVE-2026-70861

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert August 2026
Rotate credentials for any high-privileged PeopleSoft accounts that may have been exposed
Restrict network access to T3 and IIOP listener ports to trusted administrative subnets only
Audit privileged account inventories and remove unnecessary high-privilege grants

Patch Information

Oracle addressed this vulnerability in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert August 2026 for the specific patch bundle applicable to PeopleSoft Enterprise 9.1 and schedule deployment based on organizational change control processes.

Workarounds

Place PeopleSoft application servers behind network segmentation that blocks T3 and IIOP from untrusted networks
Enforce multi-factor authentication for all privileged PeopleSoft and WebLogic administrative accounts
Enable the WebLogic connection filter to allow T3/IIOP only from specific administrative hosts

bash

# Example WebLogic connection filter rule restricting T3/IIOP access
# Configure via WebLogic Admin Console: Domain > Security > Filter
10.0.0.0/8 * 7001 allow t3 t3s iiop iiops
0.0.0.0/0 * 7001 deny t3 t3s iiop iiops