CVE-2026-87401 Oracle Corporation CVE debrief

Who should care

Defenders and administrators responsible for PeopleSoft Enterprise PeopleTools installations, especially those with versions 8.61-8.63, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-87401 is a low-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows low-privileged attackers to compromise the system and access sensitive data. Defenders should prioritize verification of exposure, especially in environments with affected versions, and consider compensating controls or monitoring.

• Potential unauthorized read access to sensitive data
• Need for verification of exposure in the environment
• Potential need for compensating controls or monitoring
• Priority for applying vendor-provided patches or updates

Technical summary

The vulnerability in PeopleSoft Enterprise PeopleTools (component: XML Publisher) allows a low-privileged attacker with logon access to compromise PeopleSoft Enterprise PeopleTools, potentially leading to unauthorized read access to a subset of accessible data. The vulnerability has a CVSS score of 3.3 and vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Defenders should prioritize verifying exposure in their environment, especially those with PeopleSoft Enterprise PeopleTools versions 8.61-8.63, and assess the need for compensating controls or monitoring.

Defensive priority

Defenders should prioritize verifying exposure in their environment, especially those with PeopleSoft Enterprise PeopleTools versions 8.61-8.63, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify PeopleSoft Enterprise PeopleTools versions in use and check for exposure
• Assess the need for compensating controls or monitoring
• Review and apply vendor-provided patches or updates
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 3.3 and vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Defenders should verify exposure in their environment and assess the need for compensating controls or monitoring. The CVE record was published on 2026-10-20T22:20:18.563Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.