CVE-2026-101422 Oracle Corporation CVE debrief

Who should care

Defenders responsible for PeopleSoft Enterprise PeopleTools deployments, particularly those using versions 8.61-8.63, should assess exposure and prioritize verification and compensating controls.

Why it matters

CVE-2026-101422 is a high-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows low privileged attackers to compromise the system, leading to data modifications or system crashes. Defenders should prioritize verifying exposure of affected versions and assessing compensating controls.

• Potential unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data.
• Potential unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.
• Verification of PeopleSoft Enterprise PeopleTools versions 8.61-8.63 for exposure.
• Assessment of network access controls to limit low privileged attacker access.

Technical summary

CVE-2026-101422 is a vulnerability in PeopleSoft Enterprise PeopleTools that allows low privileged attackers with network access via HTTP to compromise the system. The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63 and has a CVSS 3.1 Base Score of 8.1, indicating high severity. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.

Defensive priority

Defenders should prioritize verifying exposure of PeopleSoft Enterprise PeopleTools versions 8.61-8.63 and assessing compensating controls.

Recommended defensive actions

• Verify PeopleSoft Enterprise PeopleTools versions 8.61-8.63 are not in use or are properly patched.
• Assess network access controls to limit low privileged attacker access.
• Monitor PeopleSoft Enterprise PeopleTools for unauthorized data modifications or system crashes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in PeopleSoft Enterprise PeopleTools. The NVD entry is currently not available. The vulnerability has a CVSS 3.1 Base Score of 8.1, indicating high severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Defenders should verify exposure of these versions and assess compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.