CVE-2026-101389

mediumpriority · track · 24EPSS 0.004 · 33 %ileDEFRNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.39% (33rd) EPSS

CVSS 5.9 · medium

Is it mine?

7 products

Check your exposure

Who says so?

4 sources

cert_bund · ncsc_nl · nvd · certfr

EPSS · scored 2026-10-27

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · secalert_us@oracle.com USexploitability 2.2 · impact 3.6

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400US

affected products (7)

Products and version ranges known to be affected.

Oracle PeopleSoft 8.61all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.61
Oracle PeopleSoft 8.61-8.63all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.61-8.63
Oracle PeopleSoft 8.62all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.62
Oracle PeopleSoft 9.1all versionscert_bundDEcpe:/a:oracle:peoplesoft:9.1
Oracle PeopleSoft 9.2all versionscert_bundDEcpe:/a:oracle:peoplesoft:9.2
Oracle Peoplesoft Enterprise Peopletools≤ vers:unknown/*ncsc_nlNL
oracle peoplesoft enterprise peopletools8.61 → 8.63nvdUScpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0439Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise NL2026-10-21csaf · ncsc_nlNL
Oracle heeft nieuwe kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise.
WID-SEC-W-2026-4082Oracle PeopleSoft: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
CERTFR-2026-AVI-1352Multiples vulnérabilités dans Oracle PeopleSoftFrançais2026-10-21vendor · certfrFR

sources

Which sources assert this record, and when.

cert_bund ncsc_nl nvd certfr NVD CVE.org MITRE

published 2026-10-20modified 2026-10-27

references (1) nvd

External citations — patches, advisories, analysis.

https://www.oracle.com/security-alerts/cpuoct2026.htmlVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan