CVE-2026-83070: Oracle PeopleSoft Authentication Bypass Flaw

CVE-2026-83070 Overview

CVE-2026-83070 is an access control vulnerability in the Oracle PeopleSoft Enterprise PRTL Interaction Hub, specifically within the Enterprise Portal component. The affected supported version is 9.1. A low-privileged attacker with network access over HTTP can exploit the flaw to compromise the Interaction Hub. The issue is classified under [CWE-284: Improper Access Control] and involves a scope change, meaning successful exploitation can impact additional Oracle products beyond the Interaction Hub itself. Confirmed impact is limited to confidentiality, with attackers gaining unauthorized access to critical data accessible through the Interaction Hub.

Critical Impact
Authenticated attackers can obtain complete unauthorized read access to sensitive PeopleSoft data across multiple integrated Oracle products.

Affected Products

Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1
Oracle PeopleSoft Enterprise Portal component
Integrated Oracle products reachable through the Interaction Hub (scope change)

Discovery Timeline

2026-09-15 - CVE-2026-83070 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83070

Vulnerability Analysis

The vulnerability exists in the Enterprise Portal component of the PeopleSoft Enterprise PRTL Interaction Hub. The Interaction Hub aggregates content and services from multiple PeopleSoft applications, exposing a unified portal for end users. Improper access control in this layer allows a low-privileged authenticated user to reach data that should be restricted to higher-privileged roles.

Because the CVSS vector includes a scope change (S:C), exploitation crosses the security boundary of the vulnerable component. Attackers can therefore access data owned or processed by other integrated Oracle products, not only the Interaction Hub. The vulnerability affects confidentiality only; integrity and availability remain unaffected.

Root Cause

The root cause is improper access control [CWE-284] within the Enterprise Portal component. Authorization checks fail to properly restrict low-privileged accounts from reading data exposed through portal integrations. Any authenticated user with basic HTTP access to the portal can trigger the condition, without user interaction and without elevated privileges.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires only low-level valid credentials to the PeopleSoft Enterprise Portal. Attack complexity is low and no user interaction is required. Once authenticated, the attacker issues crafted HTTP requests to portal endpoints that improperly enforce authorization, retrieving data belonging to the Interaction Hub and connected PeopleSoft products.

No public proof-of-concept exploit code is available at the time of publication. Technical details are described in the Oracle Security Alert CSPUSEP2026.

Detection Methods for CVE-2026-83070

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Enterprise Portal endpoints that expose cross-application data
Unusual volume of successful portal data retrievals from a single authenticated session
Access to portlets or integration points outside a user's normal role scope

Detection Strategies

Review PeopleSoft PIA (PeopleSoft Internet Architecture) web server logs for authenticated sessions issuing requests to portal resources beyond their assigned homepage or pagelet permissions
Correlate application server audit logs with role assignments to identify authorization anomalies
Enable and monitor PeopleSoft Portal registry access auditing for privilege boundary violations

Monitoring Recommendations

Forward PeopleSoft web, application, and database audit logs to a centralized SIEM for behavioral analysis of portal access patterns
Alert on repeated 200-response HTTP requests from a single session to sensitive portlets across multiple integrated applications
Baseline normal user access patterns per role and alert on statistically significant deviations

How to Mitigate CVE-2026-83070

Immediate Actions Required

Apply the Oracle security patch referenced in Oracle Security Alert CSPUSEP2026 to all PeopleSoft Enterprise PRTL Interaction Hub 9.1 deployments
Inventory all low-privileged PeopleSoft accounts and review their assigned portal permission lists and roles
Restrict network access to the PeopleSoft portal to trusted networks or VPN users where feasible

Patch Information

Oracle has released a fix for CVE-2026-83070 as part of Oracle Security Alert CSPUSEP2026. Administrators should download the corresponding patch bundle for PeopleSoft Enterprise PRTL Interaction Hub 9.1 from My Oracle Support and apply it in accordance with the Oracle patching guidance. Full advisory details are available in the Oracle Security Alert CSPUSEP2026.

Workarounds

Tighten permission lists and roles so that low-privileged users cannot reach portal registry entries linked to sensitive integrated applications
Disable unused portlets and pagelets in the Enterprise Portal to reduce the attack surface
Enforce multi-factor authentication for portal logins to raise the bar for credential-based exploitation

bash

# Configuration example: restrict portal access at the web tier
# Example Apache/OHS access restriction in front of PeopleSoft PIA
<Location /psp/>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>