CVE-2026-91505: PeopleSoft PeopleTools Privilege Escalation

CVE-2026-91505 Overview

CVE-2026-91505 affects the Porting component of Oracle PeopleSoft Enterprise PeopleTools. Supported versions 8.61 and 8.62 are affected. The vulnerability allows a high-privileged attacker with logon access to the infrastructure running PeopleTools to compromise the application. Successful exploitation leads to unauthorized creation, modification, or deletion of critical data, and full read access to all PeopleTools-accessible data.

Oracle disclosed the issue in the October 2026 Critical Patch Update. The flaw requires local access and elevated privileges, which limits remote attack scenarios but still presents risk from compromised administrative accounts or insider threats.

Critical Impact
Authenticated local attackers can achieve full read and write access to critical PeopleSoft data, undermining confidentiality and integrity of enterprise business records.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Porting component of PeopleSoft Enterprise PeopleTools

Discovery Timeline

2026-10-20 - CVE-2026-91505 published to NVD as part of Oracle's October 2026 Security Alert
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-91505

Vulnerability Analysis

The vulnerability resides in the Porting component of Oracle PeopleSoft Enterprise PeopleTools. Oracle's advisory describes it as easily exploitable by an attacker who already holds high privileges on the infrastructure hosting PeopleTools. The attack vector is local, meaning the adversary must authenticate to the host or an adjacent management interface before triggering the flaw.

Once exploited, the attacker gains unauthorized access to all data accessible by PeopleTools and can create, modify, or delete that data. Availability is not impacted, but the confidentiality and integrity exposure covers business-critical PeopleSoft records such as HR, financials, and supply chain data stored within the application.

Oracle has not published CWE identifiers or deeper technical details beyond the advisory. The Porting component typically handles cross-platform data and code migration logic within PeopleTools, which is a sensitive surface for administrative abuse.

Root Cause

Oracle has not disclosed the specific root cause. Based on the advisory, the weakness permits a privileged local user to perform data operations that should be restricted by application-level controls. The flaw likely stems from insufficient authorization checks within the Porting component's data handling paths.

Attack Vector

An attacker requires authenticated logon access to the infrastructure where PeopleTools executes. User interaction is not required. After authenticating, the attacker interacts with the vulnerable Porting component to read or alter PeopleSoft data outside their intended authorization boundary. The scope remains unchanged, so the impact stays within the PeopleTools security context.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score reflects a low probability of near-term exploitation.

// No verified exploit code is available for CVE-2026-91505.
// Refer to the Oracle October 2026 Critical Patch Update advisory
// for vendor-supplied technical details.

Detection Methods for CVE-2026-91505

Indicators of Compromise

Unexpected logon sessions on PeopleTools application servers from high-privileged accounts outside normal maintenance windows
Anomalous invocation of Porting component utilities or data migration jobs not tied to a scheduled change
Unauthorized modifications to PeopleSoft tables containing HR, financial, or configuration data

Detection Strategies

Audit PeopleTools administrative activity and correlate privileged logons with change tickets
Enable database-level auditing on PeopleSoft schemas to capture INSERT, UPDATE, and DELETE operations against critical tables
Compare PeopleTools binaries and configuration against known-good baselines after each patch cycle

Monitoring Recommendations

Forward PeopleTools application, web server, and OS logs to a centralized SIEM for correlation
Alert on privileged account use on PeopleSoft hosts outside approved maintenance windows
Monitor for lateral movement toward PeopleSoft infrastructure from workstations and jump hosts

How to Mitigate CVE-2026-91505

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to PeopleTools 8.61 and 8.62 as soon as change windows permit
Inventory all PeopleSoft Enterprise PeopleTools deployments and confirm version levels against the Oracle advisory
Review and reduce the number of accounts with high-privileged logon access to PeopleTools infrastructure

Patch Information

Oracle released fixes in the Oracle Security Alert October 2026. Administrators should follow Oracle's PeopleTools patch application procedure and validate the fix in a non-production environment before promoting to production.

Workarounds

Restrict interactive and remote logon to PeopleTools hosts to a small set of named administrators
Enforce multi-factor authentication for all accounts able to reach PeopleTools servers
Segment PeopleSoft infrastructure from general corporate networks using jump hosts and strict firewall rules
Rotate credentials for privileged PeopleSoft and database accounts if compromise is suspected

bash

# Example: restrict SSH logon to PeopleTools hosts to a dedicated admin group
# /etc/ssh/sshd_config
AllowGroups peopletools-admins
PermitRootLogin no
PasswordAuthentication no