CVE-2026-87352 Oracle Corporation CVE debrief

Who should care

System administrators and security teams responsible for PeopleSoft Enterprise PeopleTools infrastructure, especially those with logon access, should assess exposure and prioritize patching and monitoring. This includes teams managing PeopleSoft Enterprise PeopleTools deployments, vulnerability management teams, and security teams focused on data integrity and access controls.

Why it matters

CVE-2026-87352 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows low-privileged attackers with logon access to potentially compromise the system, leading to unauthorized data access and modifications. System administrators and security teams should assess exposure, prioritize patching, and monitor for suspicious activity.

• Potential unauthorized data updates, insertions, and deletions
• Potential unauthorized read access to sensitive data
• Need for logon access controls and data integrity checks
• Priority for applying vendor patches when available

Technical summary

The vulnerability in PeopleSoft Enterprise PeopleTools (component: LDAP) allows low-privileged attackers with logon access to compromise the system, potentially leading to unauthorized data updates, insertions, deletions, and read access. The CVSS 3.1 Base Score is 4.4 (Confidentiality and Integrity impacts). Affected versions are 8.61-8.63 of PeopleSoft Enterprise PeopleTools. Successful attacks can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.

Defensive priority

Medium priority for logon access controls and data integrity checks

Recommended defensive actions

• Review and limit logon access to PeopleSoft Enterprise PeopleTools infrastructure
• Monitor for unauthorized data updates, insertions, and deletions
• Verify data integrity and perform regular backups
• Apply vendor patches when available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. The vulnerability is in the LDAP component of PeopleSoft Enterprise PeopleTools. The CVSS Vector is (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Defenders should verify affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.