CVE-2026-73954: PeopleSoft PeopleTools Auth Bypass Vulnerability

CVE-2026-73954 Overview

CVE-2026-73954 is a high-severity vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. Supported versions 8.61 through 8.63 are affected. An unauthenticated attacker with network access over HTTP can compromise the product, though exploitation is rated as difficult. Successful attacks can result in complete takeover of PeopleSoft Enterprise PeopleTools, with high impact to confidentiality, integrity, and availability. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to take over PeopleSoft Enterprise PeopleTools, exposing sensitive enterprise business data and application logic.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-09-15 - CVE-2026-73954 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73954

Vulnerability Analysis

The flaw resides in the Business Interlink component of PeopleSoft Enterprise PeopleTools. Business Interlink is an integration framework used to connect PeopleSoft applications with external systems over HTTP. The vulnerability permits an unauthenticated attacker to reach the component across a network and achieve full product takeover. Oracle rates the exploit as difficult, indicating that attack conditions or timing prerequisites exist beyond a simple request-response interaction. However, the absence of authentication or user interaction requirements makes internet-exposed instances especially concerning.

Root Cause

The issue is categorized as CWE-284: Improper Access Control. Access control checks within the Business Interlink processing path are insufficient to prevent an unauthenticated remote actor from invoking privileged functionality. Oracle has not published detailed root cause analysis. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-provided context.

Attack Vector

Exploitation occurs over the network via HTTP against a PeopleSoft Enterprise PeopleTools deployment exposing the Business Interlink component. No credentials or user interaction are required. Because the scope is unchanged and impact spans confidentiality, integrity, and availability, a successful attacker can read, modify, and disrupt data managed by PeopleSoft Enterprise PeopleTools. Public proof-of-concept code is not currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code has been published. See the Oracle Security Alert CSPUSEP2026 for authoritative technical guidance.

Detection Methods for CVE-2026-73954

Indicators of Compromise

Unexpected HTTP requests targeting Business Interlink endpoints from unauthenticated or unrecognized sources.
Anomalous outbound connections from PeopleSoft application servers to attacker-controlled infrastructure.
New or modified PeopleSoft configurations, integration definitions, or administrative accounts without a documented change record.
PeopleSoft application or web server processes spawning shells or scripting interpreters.

Detection Strategies

Inspect web server and application server logs for anomalous HTTP requests referencing Business Interlink URLs or handlers.
Correlate PeopleSoft audit logs with authentication events to identify actions performed without a corresponding sign-in.
Deploy network signatures on perimeter and internal segmentation devices to flag malformed HTTP traffic to PeopleTools listeners.

Monitoring Recommendations

Baseline normal Business Interlink traffic volumes and alert on deviations, particularly requests originating from external IP ranges.
Monitor file integrity on PeopleTools installation directories, application server binaries, and configuration files.
Enable database-level auditing for privileged accounts used by PeopleSoft to detect unauthorized data access or modification.

How to Mitigate CVE-2026-73954

Immediate Actions Required

Apply the security patches referenced in the Oracle Security Alert CSPUSEP2026 to PeopleTools versions 8.61, 8.62, and 8.63.
Inventory all PeopleSoft Enterprise PeopleTools deployments and confirm patch level against the vendor advisory.
Restrict network exposure of PeopleSoft web and application tiers to authenticated corporate networks or VPN endpoints.
Review recent PeopleSoft audit and web server logs for signs of exploitation attempts prior to patching.

Patch Information

Oracle addressed CVE-2026-73954 in the Security Alert CSPUSEP2026. Administrators should apply the corresponding PeopleTools patch bundle to all affected instances of versions 8.61 through 8.63. Follow Oracle's standard patch application procedures, including backup, test environment validation, and post-installation verification. Consult the Oracle Security Alert CSPUSEP2026 for version-specific fix references and installation instructions.

Workarounds

Disable the Business Interlink component or its HTTP endpoints if it is not required for business operations.
Place a web application firewall in front of PeopleSoft to filter unauthenticated requests targeting Business Interlink URLs.
Enforce strict network access control lists so that only trusted integration partners can reach PeopleTools HTTP listeners.
Segment PeopleSoft application servers away from general user networks and internet-facing zones.

bash

# Example: restrict inbound HTTP access to PeopleSoft application server
# Replace 10.0.0.0/24 with the trusted integration subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP