CVE-2026-73955

CVE-2026-73955 is a vulnerability in the Charting component of Oracle PeopleSoft Enterprise PeopleTools affecting versions 8.61 through 8.63. A low-privileged authenticated attacker with HTTP network access can exploit the flaw, but a successful attack requires interaction from a victim other than the attacker (consistent with a CSRF- or malicious-link-style attack) and is rated easy to exploit (AC:L). If successful, the attacker gains unauthorized creation, deletion, or modification of critical PeopleSoft data, as well as unauthorized read access to critical data or all data accessible through the compromised PeopleTools instance — a high impact on both confidentiality and integrity, with no availability impact (CVSS 3.1: 7.3). Any organization running PeopleTools 8.61–8.63 exposed to network users is affected. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog and no public proof of concept is known, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-73955 and upgrade PeopleTools from 8.61–8.63 to the fixed release specified in Oracle's advisory. Restrict HTTP access to PeopleSoft internet-facing endpoints (VPN/allowlisting) and enforce strong session and CSRF protections to blunt the required human-interaction vector. Review audit logs for anomalous create/delete/modify activity by low-privileged accounts in charting-related pages.