PeopleSoft Security Flaw: Critical Data at Risk via HTTP

The National Vulnerability Database (NVD) has detailed CVE-2026-34309, a high-severity vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. This flaw, rated with a CVSS 3.1 Base Score of 8.1, allows low-privileged attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.

The exploit is straightforward, granting unauthorized creation, deletion, or modification of critical data. Attackers can also gain complete access to all PeopleSoft Enterprise PeopleTools accessible data. This isn’t just a data leak; it’s a full integrity and confidentiality hit, with the potential for significant operational disruption and data manipulation.

For defenders, this means a low-effort attack can yield high-impact results. The attacker’s calculus is simple: find an exposed PeopleSoft instance, leverage a low-privilege account (which are often poorly managed), and gain control over sensitive business data. This isn’t theoretical; this is a direct path to data compromise and potential system manipulation.