CVE-2026-83019

An easily exploitable vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools allows a low-privileged attacker with network access via HTTP to compromise PeopleTools, gaining unauthorized access to critical data (or all PeopleTools-accessible data) and the ability to hang or repeatedly crash the service for complete denial of service. Exploitation requires valid low-privilege credentials and no user interaction, so realistic attackers are malicious insiders, compromised accounts, or users on networks that can reach the PeopleSoft web tier. Confidentiality and availability are severely impacted, but integrity is not affected per the CVSS vector (C:H/I:N/A:H). Oracle has addressed the flaw in its Critical Patch Update for the affected PeopleTools 8.61-8.63 releases, and there is no known public proof of concept or confirmed in-the-wild exploitation. Organizations running affected versions, especially those with internet-facing PeopleSoft instances, are the primary exposure.

What to do: Apply Oracle's latest Critical Patch Update for PeopleTools to remediate the SQR flaw in versions 8.61-8.63, prioritizing any instances reachable from the internet or untrusted networks. Restrict HTTP access to the SQR component and PeopleSoft web tier to trusted networks or VPN, audit low-privilege accounts for anomalous activity, and monitor logs for unusual data access patterns or repeated crashes and hangs.