CVE-2026-83016

CVE-2026-83016 is a difficult-to-exploit flaw in the SQR (Structured Query Reporter) component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. Exploitation requires an attacker who already holds high privileges and local logon access to the infrastructure running PeopleTools, plus interaction from a second person (e.g., tricking another user into opening or processing a malicious SQR report or file). A successful attack results in full takeover of PeopleTools, and because of a scope change, it may also significantly impact additional products beyond PeopleTools itself. The CVSS 3.1 base score is 7.2 (high), driven by high confidentiality, integrity, and availability impacts despite the demanding prerequisites. No public proof of concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and there is no indication of in-the-wild exploitation; a fix is delivered through Oracle's Critical Patch Update.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE and verify you are on a patched PeopleTools release if currently on 8.61–8.63. Restrict local OS and administrator access on PeopleSoft servers to a minimal set of trusted accounts, since exploitation requires high-privilege local logon plus a victim's interaction. Review SQR report sources and job submission logs for unexpected or user-supplied report files, and remind administrators not to process untrusted SQR content.