CVE-2026-101420: Flaw in Oracle Corporation PeopleSoft Enterprise PeopleTools Scores 9.6 on CVSS

Oracle Corporation PeopleSoft Enterprise PeopleTools is affected by CVE-2026-101420, a security flaw that the National Vulnerability Database rates 9.6 out of 10.

At a glance

CVE

CVE-2026-101420

Product

Oracle Corporation PeopleSoft Enterprise PeopleTools

CVSS

9.6 Critical

Weakness

—

Exploited

No known exploitation

What is the vulnerability?

The NVD entry states: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

Affected versions

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

Is it being exploited?

There is no public confirmation of exploitation at the time of publication. It does not appear in CISA's Known Exploited Vulnerabilities catalog. We will update this report if that changes.

What should you do?

• Identify whether the affected product and versions run in your environment.
• Apply the vendor update listed in the advisory as soon as it is available.
• Limit network exposure of the affected service until it is patched.
• Monitor the vendor advisory for updated guidance or exploitation reports.

What to do and how to stay safe: CVE-2026-101420

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-101420?

CVE-2026-101420 is a security vulnerability in Oracle Corporation PeopleSoft Enterprise PeopleTools.

How severe is CVE-2026-101420?

It has a CVSS score of 9.6 Critical.

Is CVE-2026-101420 being exploited?

There is no public confirmation of exploitation at the time of publication.