CVE-2026-21938: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.
Affects Oracle PeopleSoft Enterprise PeopleToolsSource CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Oracle CorporationPeopleSoft Enterprise PeopleTools | Affected
| Fixed in– |
AI-suggested
- Apply official Oracle patches immediately once available; monitor Oracle security advisories for updates related to CVE-2026-21938.
- Implement strict network segmentation to limit HTTP access to PeopleSoft Enterprise PeopleTools portals only to trusted internal users and systems.
- Enforce multi-factor authentication (MFA) for access to PeopleSoft portals to reduce risk from compromised credentials.
- Conduct targeted user awareness training focusing on phishing and social engineering risks, emphasizing the need to avoid interacting with suspicious links or content.
- Monitor PeopleSoft logs and network traffic for unusual activities indicative of exploitation attempts, such as unauthorized data changes or access patterns.
- Restrict permissions within PeopleSoft to the minimum necessary, limiting the potential damage from unauthorized access.
- Employ web application firewalls (WAF) with custom rules to detect and block suspicious HTTP requests targeting PeopleSoft components.
- Regularly review and update incident response plans to include scenarios involving PeopleSoft compromise.
- Consider deploying endpoint protection solutions capable of detecting malicious payloads delivered via social engineering.
- Coordinate with Oracle support and security teams for guidance and threat intelligence sharing.
Description
CVE-2026-21938 is a medium-severity vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, and 8.62. It allows an unauthenticated attacker with network access via HTTP to exploit the system, but requires user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized read, insert, update, or delete access to some PeopleSoft accessible data, impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 6.1 and involves a scope change, potentially affecting additional products beyond PeopleTools. No known exploits are currently reported in the wild.