CVE-2026-87355 Oracle Corporation CVE debrief

Who should care

Defenders of PeopleSoft Enterprise PeopleTools instances, security teams, and IT administrators. They should assess exposure, prioritize patching, and monitor for suspicious activity to prevent potential unauthorized access and disruption of business operations.

Why it matters

CVE-2026-87355 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that requires human interaction for exploitation. Defenders should assess exposure, prioritize patching, and monitor for suspicious activity to prevent potential unauthorized access and disruption of business operations.

• Potential unauthorized access to sensitive data
• Possible disruption of business operations
• Need for patching and remediation efforts
• Requirement for monitoring and incident response preparedness

Technical summary

The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63 and allows a low-privileged attacker with network access via HTTP to compromise the product. Successful attacks require human interaction and can result in unauthorized update, insert or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. The vulnerability has a CVSS score of 4.4 and a CVSS severity of MEDIUM. The CVSS vector is (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N). Defenders should assess exposure, prioritize patching, and monitor for suspicious activity to prevent potential unauthorized access and disruption of business operations.

Defensive priority

Assess exposure, prioritize patching, and monitor for suspicious activity

Recommended defensive actions

• Assess exposure of PeopleSoft Enterprise PeopleTools instances
• Prioritize patching to prevent potential unauthorized access
• Monitor for suspicious activity requiring human interaction
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but scope and remediation require verification. The vulnerability has a CVSS score of 4.4 and a CVSS severity of MEDIUM. The CVE record was published on 2026-10-20T22:20:13.310Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS vector.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.