Unauthenticated Remote Code Execution in Oracle PeopleSoft Enterprise PeopleTools

CVE-2026-21938

What is CVE-2026-21938?

A vulnerability exists in the Oracle PeopleSoft Enterprise PeopleTools, specifically within the Portal component, impacting versions 8.60, 8.61, and 8.62. This vulnerability can be easily exploited by an unauthenticated attacker with network access via HTTP, allowing unauthorized updates, inserts, or deletions of accessible data. While the attacks necessitate human interaction from another individual, they can have broader implications, potentially affecting additional products. The security risk associated with this issue encompasses both confidentiality and integrity impacts, exposing data vulnerabilities that organizations need to address promptly.

References