CVE-2026-83015

CVE-2026-83015 is a difficult-to-exploit local privilege escalation vulnerability in the Cube Manager component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported versions 8.61 through 8.63. It is triggered by a low-privileged attacker who already has logon access to the host or infrastructure where PeopleTools executes, and it requires no user interaction. A successful attack allows the attacker to fully compromise PeopleSoft Enterprise PeopleTools, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.0). Only organizations running PeopleTools 8.61-8.63 with accessible server or infrastructure accounts are exposed; remote unauthenticated exploitation is not possible per the vector (AV:L/AC:H/PR:L). The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so exploitation in the wild is unlikely at this time.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw and move affected PeopleTools 8.61-8.63 environments to a fixed, supported release. Restrict and audit local OS and application accounts on PeopleSoft web, app, and batch servers to least privilege, since exploitation requires an existing low-privileged logon. Review authentication and privilege-escalation logs on hosts running Cube Manager for suspicious activity by low-privileged accounts.