CVE-2026-34269 affects Oracle PeopleSoft Enterprise PeopleTools (Portal component) versions 8.61-8.62. It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the system, contingent on human interaction from a person other than the attacker. The vulnerability can result in unauthorized read and write (update, insert, delete) access to certain PeopleSoft Enterprise PeopleTools data. The scope of impact may extend beyond PeopleTools to other Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle’s April 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for it. Customers should consult the advisory for detailed patch information.

Successful exploitation allows unauthorized read and modification (update, insert, delete) of some PeopleSoft Enterprise PeopleTools accessible data. The vulnerability requires human interaction from a third party and affects confidentiality and integrity of data. The scope of impact extends beyond PeopleTools to additional Oracle products. There is no impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle’s April 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for CVE-2026-34269. Customers are strongly advised to review the April 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html and apply all relevant patches promptly. Maintaining up-to-date patching on supported versions is critical to mitigate this vulnerability. Until explicit patch information is confirmed, organizations should consider risk mitigation strategies consistent with the vulnerability’s characteristics, including limiting network exposure of PeopleSoft Enterprise PeopleTools and educating users to reduce risk of social engineering that could trigger the required human interaction.