CVE-2026-101488

mediumpriority · track · 26OT risk · elevatedEPSS 0.004 · 30 %ileDEFRNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.36% (30th) EPSS

CVSS 6.5 · medium

Is it mine?

7 products

Check your exposure

Who says so?

4 sources

cert_bund · ncsc_nl · nvd · certfr

EPSS · scored 2026-10-28

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Lprimary · secalert_us@oracle.com USexploitability 3.9 · impact 2.5

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Lsecondary · NCSC-NL NL

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USprimaryCWE-200USLLM-inferredCWE-400USLLM-inferred

affected products (7)

Products and version ranges known to be affected.

Oracle PeopleSoft 8.61all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.61
Oracle PeopleSoft 8.61-8.63all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.61-8.63
Oracle PeopleSoft 8.62all versionscert_bundDEcpe:/a:oracle:peoplesoft:8.62
Oracle PeopleSoft 9.1all versionscert_bundDEcpe:/a:oracle:peoplesoft:9.1
Oracle PeopleSoft 9.2all versionscert_bundDEcpe:/a:oracle:peoplesoft:9.2
Oracle Peoplesoft Enterprise Peopletools≤ vers:unknown/*ncsc_nlNL
oracle peoplesoft enterprise peopletools8.61 → 8.63nvdUScpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0439Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise NL2026-10-21csaf · ncsc_nlNL
Oracle heeft nieuwe kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise.
WID-SEC-W-2026-4082Oracle PeopleSoft: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
CERTFR-2026-AVI-1352Multiples vulnérabilités dans Oracle PeopleSoftFrançais2026-10-21vendor · certfrFR

sources

Which sources assert this record, and when.

cert_bund ncsc_nl nvd certfr NVD CVE.org MITRE

published 2026-10-20modified 2026-10-26

related (4,472)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-67277US	high8.2OT critical	1.56% (75th)	KEV	2026-09-05
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 U…
CVE-2026-81578US	critical9.8OT critical	83.7% (100th)	KEV	2026-08-28
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting…
CVE-2026-72529US	—OT critical	1.46% (74th)	KEV	2026-08-19
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an ar…
CVE-2026-56164US	critical9.8OT critical	1.01% (63rd)	KEV	2026-07-14
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-59822US	high8.2OT critical	0.84% (58th)	KEV	2026-07-08
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to…

+4467 more

references (1) nvd

External citations — patches, advisories, analysis.

https://www.oracle.com/security-alerts/cpuoct2026.htmlVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan