CVE-2026-73960: PeopleSoft PeopleTools DOS Vulnerability

CVE-2026-73960 Overview

CVE-2026-73960 is a denial-of-service vulnerability in the Ren Server component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.61 through 8.63. An unauthenticated attacker with network access over HTTP can trigger a hang or repeatable crash, resulting in a complete denial of service. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption) and carries availability-only impact with no confidentiality or integrity effect.

Critical Impact
Remote, unauthenticated attackers can crash or hang PeopleSoft Enterprise PeopleTools instances via HTTP requests to the Ren Server, disrupting business-critical ERP workloads.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-09-15 - CVE-2026-73960 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73960

Vulnerability Analysis

The vulnerability resides in the Ren Server (Real-time Event Notification) component of PeopleSoft Enterprise PeopleTools. Ren Server brokers asynchronous messaging between the PeopleSoft application server and browser clients over HTTP. The defect allows a remote attacker to submit crafted HTTP traffic that consumes or exhausts server-side resources. The result is either a service hang or a repeatable process crash that stops all Ren Server activity.

The attack requires no authentication, no user interaction, and only network reachability to the Ren Server HTTP endpoint. Exploitation impacts availability only; the flaw does not expose data or allow modification of records. In enterprise deployments, however, an outage of Ren Server disrupts push notifications, real-time alerts, and integration components that depend on it.

Root Cause

The issue maps to [CWE-400] Uncontrolled Resource Consumption. The Ren Server does not adequately constrain the resources consumed while processing certain HTTP requests. Repeated or malformed requests trigger the resource-exhaustion condition that terminates or freezes the service.

Attack Vector

Exploitation occurs over the network via HTTP. An attacker needs only to reach the Ren Server listener, which is typically exposed to internal users and, in many deployments, to internet-facing reverse proxies. Because the vector requires no credentials, any actor able to send HTTP traffic to the endpoint can trigger the condition. Refer to the Oracle Security Alert for vendor-specific technical detail.

Detection Methods for CVE-2026-73960

Indicators of Compromise

Unexpected Ren Server process termination or hang events in PeopleSoft application server logs.
Sudden spikes of HTTP requests directed at Ren Server endpoints from a single or small set of source addresses.
Sustained high CPU, memory, or thread counts on the Ren Server host without corresponding legitimate user activity.
Loss of real-time notifications or messaging functionality reported by end users.

Detection Strategies

Monitor PeopleSoft Ren Server logs and Tuxedo domain logs for repeated restart or crash events.
Baseline normal Ren Server HTTP request rates and alert on anomalous deviations.
Correlate web-tier access logs with backend Ren Server availability to identify HTTP patterns that precede crashes.

Monitoring Recommendations

Enable application-layer telemetry on the PeopleSoft web tier and forward logs to a centralized SIEM for correlation.
Configure availability probes against Ren Server endpoints to detect hangs before users report outages.
Track process-level metrics on PeopleSoft hosts, including handle counts, thread counts, and memory utilization, to identify resource exhaustion in progress.

How to Mitigate CVE-2026-73960

Immediate Actions Required

Apply the Oracle patches referenced in the Oracle Security Alert for PeopleTools 8.61, 8.62, and 8.63.
Restrict network access to Ren Server endpoints so that only trusted application tiers and authenticated user networks can reach them.
Inventory all PeopleSoft PeopleTools deployments and confirm version levels against the affected range.

Patch Information

Oracle addressed CVE-2026-73960 in the security update tracked by the Oracle Security Alert. Administrators should apply the associated Critical Patch Update to all PeopleTools 8.61 through 8.63 environments, including development, test, and production tiers.

Workarounds

Place the Ren Server behind a web application firewall or reverse proxy configured with strict request-rate limits and connection ceilings.
Enforce network segmentation to block untrusted sources from reaching Ren Server HTTP listeners.
Configure PeopleSoft web-tier timeouts and connection limits to reduce the impact of resource-exhaustion attempts until patches are applied.
Monitor and automatically restart Ren Server processes to reduce mean time to recovery if a crash occurs.

bash

# Example: restrict Ren Server access to trusted subnets using iptables
iptables -A INPUT -p tcp --dport 7180 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7180 -j DROP