Loading vulnerability…
Improper access control in Oracle PeopleSoft Enterprise PeopleTools Security component
CVE-2026-34309 is an easily exploitable vulnerability in the Security component of Oracle PeopleSoft Enterprise PeopleTools affecting supported versions 8.61 through 8.62. The issue is reachable over HTTP by an attacker who already has low-privileged access. Oracle states that successful exploitation can compromise PeopleSoft Enterprise PeopleTools data by enabling unauthorized access to sensitive information and unauthorized modification of accessible data. Publicly available information identifies the affected product, component, attack vector, required privilege level, and resulting confidentiality and integrity impact, but does not disclose the specific vulnerable function or root cause.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in high confidentiality and integrity impact within PeopleSoft Enterprise PeopleTools. An attacker may gain unauthorized access to critical data or complete access to all data accessible through the affected PeopleTools deployment, and may also create, delete, or modify critical data or all accessible data without authorization. No availability impact is indicated in the published CVSS vector.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the PeopleSoft Enterprise PeopleTools HTTP interface to only trusted networks and users, minimize the number and privileges of application accounts, enforce strong access controls around administrative and sensitive functions, and monitor for unauthorized data access or modification activity. No specific vendor-supplied workaround is available in the provided information.
Patch, then assume compromise.
Apply the Oracle security updates provided for CVE-2026-34309 in the April 2026 Critical Patch Update. Priority should be given to affected PeopleSoft Enterprise PeopleTools deployments running versions 8.61 through 8.62, especially systems exposed over HTTP to users with low-privileged accounts.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.