CVE-2026-87264: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-87264 Overview

CVE-2026-87264 is an access control vulnerability in the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects PeopleTools versions 8.61 through 8.63. A low-privileged attacker with network access over HTTP can exploit this weakness without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data across PeopleSoft Enterprise PeopleTools. The vulnerability produces a scope change, meaning attacks can extend impact to additional Oracle products beyond the vulnerable component. Oracle disclosed the issue in Security Alert CSPUSEP2026.

Critical Impact
Authenticated attackers can tamper with critical PeopleSoft data across trust boundaries, affecting integrity of connected products through Integration Broker.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-09-15 - CVE-2026-87264 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87264

Vulnerability Analysis

The vulnerability resides in the Integration Broker component of PeopleTools. Integration Broker is the messaging framework PeopleSoft uses to exchange data between PeopleSoft applications and external systems. The flaw is classified under [CWE-284] Improper Access Control. An authenticated attacker with low privileges can send crafted HTTP requests to Integration Broker endpoints. These requests bypass authorization checks and reach operations that modify PeopleSoft data. The scope change indicator means the compromised component grants access to resources managed by other trust zones. Confidentiality and availability are not directly affected, but integrity impact is high across accessible data sets.

Root Cause

The root cause is improper access control in Integration Broker request handling. The component fails to enforce sufficient authorization on operations that create, delete, or modify PeopleSoft data. Because Integration Broker operates as a bridge between PeopleSoft and external systems, weak authorization on message processing extends the blast radius beyond PeopleTools itself. Oracle has not published detailed technical internals. Refer to the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Attack Vector

Exploitation requires network reachability to the PeopleSoft Integration Broker HTTP interface and a low-privileged account. No user interaction is required. Attack complexity is low, meaning the exploit does not depend on race conditions or specialized environmental factors. An attacker sends HTTP requests to Integration Broker endpoints that trigger data-modifying operations without proper authorization enforcement. The EPSS score is 0.255% at the 17th percentile, indicating limited observed exploitation activity to date.

No verified public proof-of-concept code has been released. Consult the Oracle Security Alert for technical remediation details.

Detection Methods for CVE-2026-87264

Indicators of Compromise

Unexpected creation, deletion, or modification of PeopleSoft records by low-privileged accounts.
Anomalous HTTP requests to Integration Broker service endpoints from unusual source addresses or user agents.
Integration Broker message logs showing operations executed outside normal integration workflows.

Detection Strategies

Baseline normal Integration Broker traffic patterns and alert on deviations in request volume, endpoint access, or account behavior.
Correlate PeopleTools audit logs with authentication events to identify low-privileged accounts performing data-modifying operations.
Inspect HTTP traffic to Integration Broker endpoints for unauthorized message types or payload manipulation.

Monitoring Recommendations

Enable verbose logging on Integration Broker service operations and forward logs to a centralized SIEM for analysis.
Monitor privileged data tables for unexpected modifications originating from Integration Broker sessions.
Track failed and successful authorization checks on Integration Broker endpoints to detect probing activity.

How to Mitigate CVE-2026-87264

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to affected PeopleTools 8.61, 8.62, and 8.63 deployments.
Inventory all PeopleSoft environments and identify Integration Broker instances exposed to untrusted networks.
Review recent Integration Broker activity logs for signs of unauthorized data modification.

Patch Information

Oracle addressed CVE-2026-87264 in the security alert published as CSPUSEP2026. Administrators should download and apply the vendor patch for PeopleTools 8.61 through 8.63 following Oracle's documented upgrade procedures. Reference the Oracle Security Alert CSPUSEP2026 for version-specific patch instructions.

Workarounds

Restrict network access to Integration Broker HTTP endpoints using firewall rules or reverse proxy allow-lists.
Enforce least-privilege on PeopleSoft user accounts to reduce the population of accounts capable of triggering the vulnerable code path.
Require mutual TLS or additional authentication proxies in front of Integration Broker service interfaces where feasible.

bash

# Example firewall restriction limiting Integration Broker access to trusted subnets
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP