Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Oracle disclosed three high-severity vulnerabilities affecting core enterprise products in its Critical Patch Update advisory. CVE-2026-34279 impacts the Event Management component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 and is rated CVSS 9.1; Oracle said a high-privileged attacker with network access over HTTP could exploit the flaw to take over the platform, with potential impact extending to additional products because of a scope change. CVE-2026-34286, also rated CVSS 9.1, affects the Core component of Oracle Identity Manager Connector in Oracle Fusion Middleware version 12.2.1.4.0 and can be exploited by an unauthenticated attacker over HTTPS.

Oracle also reported CVE-2026-34309 in the Security component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.62, assigning it a CVSS 8.1 score. The flaw is described as easily exploitable by a low-privileged attacker with network access over HTTP and could allow unauthorized creation, deletion, or modification of critical data, along with access to sensitive or complete accessible data. Across the three disclosures, Oracle warned that successful exploitation could result in platform compromise, data tampering, and broad unauthorized access in widely deployed enterprise management and identity systems.