PT-2026-3688 · Oracle · Peoplesoft Enterprise Peopletools+1

CVE-2026-21938 · Published 2026-01-20 · Updated 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft versions 8.60 through 8.62

Description A flaw exists within the Portal component of Oracle PeopleSoft Enterprise PeopleTools that allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation requires interaction from a user other than the attacker and may impact other products. Exploitation can lead to unauthorized data modification, insertion, or deletion, as well as unauthorized read access to some data.

Recommendations Update PeopleSoft Enterprise PeopleTools version 8.60 to a later version. Update PeopleSoft Enterprise PeopleTools version 8.61 to a later version. Update PeopleSoft Enterprise PeopleTools version 8.62 to a later version.

Fix

Related Identifiers

CVE-2026-21938

Affected Products

Peoplesoft

Peoplesoft Enterprise Peopletools

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-21938 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21938 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://twitter.com/CVEnew/status/2013783018629144822 · Twitter Post