PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47051 Oracle Corporation CVE debrief

A vulnerability was discovered in PeopleSoft Enterprise PeopleTools of Oracle PeopleSoft. The affected versions are 8.61 and 8.62. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.

Vendor
Oracle Corporation
Product
PeopleSoft Enterprise PeopleTools
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system deployments, applying patches, restricting network access, monitoring for suspicious activities, and ensuring human interaction requirements are met to prevent exploitation. Additionally, they should review and update access controls to prevent unauthorized data access and modifications, and track exceptions and retest remediated assets.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 5.4, indicating a medium severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, requiring human interaction from another person. Successful attacks can lead to unauthorized data access and modifications.

Defensive priority

Medium priority due to the CVSS score and the potential impact on data integrity and confidentiality.

Recommended defensive actions

  • Apply the patches provided by Oracle as mentioned in the July 2026 CPU advisory.
  • Restrict network access to PeopleSoft Enterprise PeopleTools to only necessary personnel.
  • Monitor and audit PeopleSoft Enterprise PeopleTools for any suspicious activities.
  • Ensure that human interaction requirements are met to prevent exploitation.
  • Review and update access controls to prevent unauthorized data access and modifications.

Evidence notes

The CVE record was published on 2026-07-21T22:17:10.790Z and was last modified on 2026-07-27T19:33:49.903Z. The NVD entry is currently Analyzed. The vulnerability details are based on the information provided by the NVD and Oracle.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47051 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47051

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47051 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47051

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.