CVE-2026-91468: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-91468 Overview

CVE-2026-91468 is an access control vulnerability in the Quick Address Search (QAS) component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.61 through 8.63. An unauthenticated attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation allows unauthorized update, insert, or delete access to a subset of PeopleTools data and can cause a partial denial of service. The vulnerability is tracked under CWE-284: Improper Access Control and was published in Oracle's October 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can modify PeopleSoft data and degrade service availability through the exposed QAS component over HTTP.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-10-20 - CVE-2026-91468 published to the National Vulnerability Database
2026-10-22 - Last updated in the NVD database

Technical Details for CVE-2026-91468

Vulnerability Analysis

The flaw resides in the QAS (Quick Address Search) component of PeopleSoft Enterprise PeopleTools. QAS exposes address lookup and validation functionality over HTTP to support data entry workflows throughout the PeopleSoft suite. The vulnerability allows an attacker to reach functionality that should require authentication or stricter authorization checks. Oracle classifies the exploit complexity as low and attack prerequisites as none, meaning no credentials, tokens, or user action are required.

Successful exploitation grants limited write access to data accessible by PeopleTools and can induce partial service degradation. Confidentiality is not impacted, but integrity and availability are both affected at a limited scope.

Root Cause

The underlying weakness maps to CWE-284: Improper Access Control. The QAS component does not sufficiently restrict who can invoke sensitive operations exposed through its HTTP interface. As a result, requests that should be gated by authentication or role checks are processed on behalf of unauthenticated callers. Oracle has not published root-cause specifics beyond the component designation in the Oracle Security Alert - October 2026 advisory.

Attack Vector

Exploitation occurs over the network via HTTP against a reachable PeopleTools instance. An attacker crafts requests against QAS endpoints to trigger unauthorized insert, update, or delete operations on exposed data objects. The same request path can be leveraged to drive the component into states that produce a partial denial of service. Internet-exposed PeopleSoft deployments and intranets without network segmentation present the highest risk. No publicly verified proof-of-concept code or exploit is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91468

Indicators of Compromise

Unauthenticated HTTP requests to QAS-related URIs on PeopleTools servers originating from unexpected source addresses.
Unexplained inserts, updates, or deletes in PeopleTools tables accessible through QAS workflows.
Spikes in HTTP 5xx responses or application worker exhaustion correlated with QAS request bursts.

Detection Strategies

Baseline normal QAS request volume and alert on deviations in request rate, source diversity, or response-code distribution.
Correlate web server access logs with PeopleSoft application audit logs to identify data modifications lacking a corresponding authenticated session.
Review web application firewall (WAF) logs for requests to QAS endpoints that bypass standard authentication flows.

Monitoring Recommendations

Forward PeopleSoft web, application, and database audit logs to a centralized analytics platform for cross-tier correlation.
Monitor availability metrics for PeopleTools application servers to catch partial denial-of-service symptoms early.
Track egress patterns from PeopleSoft hosts to identify follow-on attacker activity after initial exploitation.

How to Mitigate CVE-2026-91468

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert - October 2026 Critical Patch Update to PeopleTools 8.61, 8.62, and 8.63.
Inventory internet-facing PeopleSoft deployments and prioritize those for immediate patching.
Review PeopleTools audit logs for anomalous insert, update, or delete activity dating back to prior to patch deployment.

Patch Information

Oracle addressed CVE-2026-91468 in the October 2026 Critical Patch Update. Administrators should obtain the appropriate PeopleTools patch bundle for versions 8.61, 8.62, and 8.63 from Oracle Support and deploy it following Oracle's standard change-management procedures. Validate patch installation by confirming the PeopleTools build number after deployment.

Workarounds

Restrict network access to PeopleTools HTTP endpoints using firewall rules or reverse proxies, limiting exposure to trusted networks only.
Disable the QAS component if it is not required by the organization's PeopleSoft workflows.
Enforce authentication at an upstream reverse proxy or WAF for any QAS endpoints that must remain reachable prior to patch deployment.

bash

# Example reverse proxy rule to restrict QAS endpoints to trusted subnets
location /psc/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://peoplesoft-backend;
}