/
← Voltar ao feed
high

CERT-FR flags multiple Oracle PeopleSoft vulnerabilities in October 2026 CPU, including remote code execution

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 19 horas

CERT-FR has published advisory CERTFR-2026-AVI-1352 on multiple vulnerabilities in Oracle PeopleSoft. The advisory says some flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service and breaches of data confidentiality. It also lists data integrity violations and security policy bypass as impacts. The advisory relies on the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1352 covers a very large set of CVEs (from CVE-2024-12798 to CVE-2026-101491) in Oracle PeopleSoft, fixed in Oracle's October 2026 Critical Patch Update (cpuoct2026, 20 October 2026). CERT-FR says some of them allow remote arbitrary code execution, remote denial of service and loss of data confidentiality. It also lists data integrity violations and security policy bypass. Affected: PeopleTools 8.61 to 8.63, and PeopleSoft Enterprise 9.2 modules (CC Common Application Objects, FIN Cash Management, HCM Global Payroll Switzerland, HCM Human Resources, SCM Manufacturing, SCM Purchasing, SCM Strategic Sourcing) and 9.1 modules (FIN Common Objects Argentina and Brazil, FIN Inventory Brazil, FIN Manufacturing Brazil, FIN Product Configurator Brazil). The advisory gives no CVSS scores, no per-CVE impact and no attacker prerequisites; fixes are the patches in the Oracle bulletin.

Como funciona

The articles do not describe how any of these vulnerabilities work. The advisory only lists the possible impacts as a group (remote code execution, remote denial of service, confidentiality and integrity breaches, policy bypass) and does not say which input reaches which component, or at what step things go wrong, for any individual CVE.

Por que é vulnerável

The articles do not state the root cause of any of the listed CVEs, nor why they went unnoticed. The advisory refers to the vendor bulletin for fixes and does not explain what the patches change.

Como foi descoberta

According to CERT-FR, the vulnerabilities were discovered in Oracle PeopleSoft and disclosed through Oracle's quarterly Critical Patch Update bulletin cpuoct2026 of 20 October 2026; CERT-FR published its advisory on 21 October 2026. The articles do not name who found the flaws or how. The advisory does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:18.

Detalhes técnicos

  • Affected: PeopleSoft Enterprise PeopleTools 8.61 to 8.63.
  • Affected PeopleSoft Enterprise 9.2 modules: CC Common Application Objects, FIN Cash Management, HCM Global Payroll Switzerland, HCM Human Resources, SCM Manufacturing, SCM Purchasing and SCM Strategic Sourcing.
  • Affected PeopleSoft Enterprise 9.1 modules: FIN Common Objects Argentina, FIN Common Objects Brazil, FIN Inventory Brazil, FIN Manufacturing Brazil and FIN Product Configurator Brazil.
  • The advisory references a very large set of CVEs, from CVE-2024-12798 to CVE-2026-101491. It gives no CVSS scores and does not map impact to individual CVEs.

Remediação

  • Apply the patches listed in the Oracle bulletin cpuoct2026 of 20 October 2026.
  • Prioritise internet-exposed PeopleSoft instances and PeopleTools deployments.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 23/10 12:01 primeiro registro

    CERT-FR flags multiple Oracle PeopleSoft vulnerabilities in October 2026 CPU, including remote code execution

    ler a análise desta fonte

    CERT-FR has published advisory CERTFR-2026-AVI-1352 on multiple vulnerabilities in Oracle PeopleSoft. The advisory says some flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service and breaches of data confidentiality. It also lists data integrity violations and security policy bypass as impacts. The advisory relies on the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: PeopleSoft Enterprise PeopleTools 8.61 to 8.63.
    • Affected PeopleSoft Enterprise 9.2 modules: CC Common Application Objects, FIN Cash Management, HCM Global Payroll Switzerland, HCM Human Resources, SCM Manufacturing, SCM Purchasing and SCM Strategic Sourcing.
    • Affected PeopleSoft Enterprise 9.1 modules: FIN Common Objects Argentina, FIN Common Objects Brazil, FIN Inventory Brazil, FIN Manufacturing Brazil and FIN Product Configurator Brazil.
    • The advisory references a very large set of CVEs, from CVE-2024-12798 to CVE-2026-101491. It gives no CVSS scores and does not map impact to individual CVEs.

    Remediation

    • Apply the patches listed in the Oracle bulletin cpuoct2026 of 20 October 2026.
    • Prioritise internet-exposed PeopleSoft instances and PeopleTools deployments.