CVE-2026-83018: PeopleSoft PeopleTools Privilege Escalation

CVE-2026-83018 Overview

CVE-2026-83018 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise PeopleTools product, specifically within the Structured Query Report (SQR) component. Affected versions span 8.61 through 8.63. The flaw allows a low-privileged attacker with logon access to the infrastructure running PeopleSoft Enterprise PeopleTools to compromise the product. Successful exploitation can result in complete takeover of PeopleSoft Enterprise PeopleTools, impacting confidentiality, integrity, and availability. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
A low-privileged local attacker can fully take over PeopleSoft Enterprise PeopleTools, gaining high-impact access to sensitive enterprise data and business processes.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-09-15 - CVE-2026-83018 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83018

Vulnerability Analysis

The vulnerability resides in the SQR component of Oracle PeopleSoft Enterprise PeopleTools. SQR is Oracle's Structured Query Report engine used to generate reports against PeopleSoft data. An attacker who already has valid logon credentials to the infrastructure hosting PeopleTools can leverage the flaw to escalate control over the PeopleTools environment. The impact extends across confidentiality, integrity, and availability, indicating full compromise of the affected component. Oracle documents the fix in the Oracle Security Alert CSPUSEP2026.

Root Cause

The underlying weakness maps to CWE-284: Improper Access Control. The SQR component does not adequately enforce access restrictions on privileged operations, permitting a low-privileged local account to perform actions reserved for higher-privileged users. Oracle has not published low-level technical internals for this issue beyond the security alert.

Attack Vector

Exploitation requires local access to the infrastructure where PeopleSoft Enterprise PeopleTools executes. The attacker needs a valid, low-privileged logon and no user interaction from another party. The exploit complexity is low, so a working technique against a vulnerable installation would be straightforward to reproduce once developed. No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing, and the EPSS forecast for exploitation is low.

No verified public exploit code is available. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-authoritative details.

Detection Methods for CVE-2026-83018

Indicators of Compromise

Unexpected SQR process execution (sqr, sqrw, psqr) invoked by low-privileged PeopleSoft service or OS accounts.
New or modified SQR program files (.sqr, .sqc) in PeopleTools installation and report directories that do not correlate with change requests.
Anomalous PeopleTools log entries showing report execution with elevated privilege contexts or unusual command-line arguments.

Detection Strategies

Monitor process creation on PeopleTools application and process-scheduler servers for SQR binaries spawned outside sanctioned job schedules.
Correlate PeopleSoft Process Scheduler audit records with OS-level authentication logs to identify SQR runs initiated by accounts that should not schedule reports.
Deploy file-integrity monitoring on the PeopleTools SQR/ and bin/ directories to detect tampering with report programs or executables.

Monitoring Recommendations

Ingest PeopleSoft application server, Process Scheduler, and OS logs into a centralized SIEM for cross-source correlation.
Baseline normal SQR execution patterns per host and alert on deviations in frequency, user context, or working directory.
Track privileged operations performed within PeopleTools shortly after low-privileged logons, which may indicate exploitation of this access control flaw.

How to Mitigate CVE-2026-83018

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all PeopleSoft Enterprise PeopleTools 8.61, 8.62, and 8.63 deployments.
Inventory PeopleTools hosts and confirm patch levels; prioritize internet-adjacent and multi-tenant environments where local logon exposure is higher.
Restrict interactive and remote logon rights on PeopleTools infrastructure to a minimal set of administrative accounts.

Patch Information

Oracle addresses this vulnerability in the security alert CSPUSEP2026. Administrators should follow Oracle's guidance for supported PeopleTools 8.61–8.63 releases and validate patch deployment in non-production environments before rolling out to production.

Workarounds

Enforce least privilege on operating system accounts that can log on to PeopleTools hosts, removing shell access from accounts that only need PeopleSoft application access.
Segment PeopleTools servers on isolated network zones and require jump-host or bastion access with multi-factor authentication.
Audit and tighten filesystem permissions on the SQR component directories so only authorized administrators can read or modify report programs and binaries.

bash

# Configuration example: restrict PeopleTools SQR directory permissions on Linux
# Replace $PS_HOME with the actual PeopleTools installation path
chown -R psadm:psadm "$PS_HOME/bin/sqr" "$PS_HOME/sqr"
chmod -R 750 "$PS_HOME/bin/sqr" "$PS_HOME/sqr"

# Limit interactive logon to the PeopleTools service account group only
# (Example for RHEL/OL using pam_access)
echo "+ : psadm psoper : ALL"  >> /etc/security/access.conf
echo "- : ALL : ALL"           >> /etc/security/access.conf