CVE-2026-87348 Oracle Corporation CVE debrief

Who should care

PeopleSoft Enterprise PeopleTools administrators, security teams, and IT professionals responsible for Oracle PeopleSoft systems should assess exposure and apply necessary patches or updates.

Why it matters

CVE-2026-87348 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows high-privileged attackers to compromise the system, potentially leading to unauthorized data access and partial denial of service. PeopleSoft Enterprise PeopleTools administrators and security teams should assess exposure and apply patches.

• Potential unauthorized data access and modification.
• Partial denial of service (DOS) of PeopleSoft Enterprise PeopleTools.
• Need for verification of system exposure and patch application.

Technical summary

The vulnerability in PeopleSoft Enterprise PeopleTools (component: Updates Environment Mgmt) allows high-privileged attackers with logon access to compromise the system. Successful attacks can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 Base Score of 4.2 and a CVSS Vector of (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). PeopleSoft Enterprise PeopleTools administrators and security teams should assess exposure and apply patches.

Defensive priority

Medium priority for PeopleSoft Enterprise PeopleTools administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of PeopleSoft Enterprise PeopleTools instances, specifically versions 8.61-8.63.
• Review and apply patches or updates provided by Oracle as necessary.
• Monitor system logs for potential unauthorized access or denial of service attempts.
• Verify high-privileged access controls and logon infrastructure security.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, additional information on potential exploits or victim organizations is not available. The vulnerability is described as easily exploitable and allows high-privileged attackers with logon access to compromise PeopleSoft Enterprise PeopleTools. Successful attacks can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.