CVE-2026-87350 Oracle Corporation CVE debrief

Who should care

System administrators and security teams responsible for PeopleSoft Enterprise PeopleTools infrastructure and data access should assess exposure and implement recommended actions to prevent potential unauthorized data access and denial of service conditions. This includes reviewing and limiting logon access, monitoring data access, and implementing additional logging and monitoring to detect potential partial denial of service conditions.

Why it matters

CVE-2026-87350 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that requires attention from system administrators and security teams to prevent potential unauthorized data access and denial of service conditions.

• Potential unauthorized data access and modifications
• Partial denial of service conditions
• Need for enhanced logon access controls and monitoring

Technical summary

The vulnerability in PeopleSoft Enterprise PeopleTools allows a low-privileged attacker with logon access to compromise the system, potentially leading to unauthorized data access and partial denial of service. The CVSS 3.1 Base Score is 4.5, indicating a medium severity vulnerability. The vulnerability affects versions 8.61-8.63 and has been assigned a CVSS Vector of (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a

Defensive priority

Medium priority for logon access controls and PeopleSoft Enterprise PeopleTools data access monitoring

Recommended defensive actions

• Review and limit logon access to PeopleSoft Enterprise PeopleTools infrastructure
• Monitor PeopleSoft Enterprise PeopleTools data access for unauthorized updates, inserts, or deletions
• Implement additional logging and monitoring for PeopleSoft Enterprise PeopleTools to detect potential partial denial of service conditions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, specific exploitation details and victim information are not provided. The vulnerability is difficult to exploit and requires logon access to the infrastructure where PeopleSoft Enterprise PeopleTools executes. Successful attacks can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise Tools

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.