CVE-2026-82993

An easily exploitable vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools allows a low-privileged authenticated attacker with HTTP network access to compromise PeopleTools, with a scope change meaning successful attacks may also significantly impact additional products beyond PeopleTools itself. Successful exploitation results in unauthorized access to critical data or complete access to all PeopleTools-accessible data, plus unauthorized update, insert, or delete access to some of that data; availability is not impacted. The flaw carries a CVSS 3.1 base score of 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Any organization running PeopleTools versions 8.61 through 8.63 is affected. There is no known public proof-of-concept, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-82993 and move PeopleTools off the affected 8.61-8.63 range to the patched release. Restrict HTTP access to the PeopleSoft Pure Internet Architecture portal (including Business Interlink endpoints) to VPN or IP allowlists so low-privileged remote users cannot reach it directly from the internet. Review audit and HTTP access logs for authenticated accounts performing unusual bulk data reads or unexpected update/insert/delete activity.