A critical, easily exploitable vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets a low-privileged attacker with network access read, create, change or delete critical data.
What Is It
CVE-2026-101420 is a vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools. Oracle ([email protected]) reported it, and NVD published it on 2026-10-20. Its NVD status is currently "Received."
Oracle calls the flaw "easily exploitable." An attacker needs only low privileges and network access over HTTP. No user interaction is needed. The vulnerability sits in PeopleTools, but the scope is marked "changed," which means a successful attack may significantly affect other products as well.
Why It Matters
Oracle rates the flaw CVSS 3.1 9.6 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
- Confidentiality: High. Attackers can gain unauthorized access to critical data, or complete access to all data reachable through PeopleSoft Enterprise PeopleTools.
- Integrity: High. Attackers can create, delete or modify critical data, or any data PeopleTools can reach.
- Availability: None. The rating lists no availability impact.
Exploitation is low-complexity, works over the network and needs only basic authenticated access. Because the scope is "changed," the damage can extend past PeopleTools itself. That combination makes this a high-priority fix for any organization running affected PeopleSoft deployments.
Exploitation status: The supplied CISA KEV data has no entry for this CVE, so CISA has not confirmed active exploitation. CISA has also published no required action or remediation deadline.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: PeopleSoft Enterprise PeopleTools
- Component: SQR
- Affected supported versions: 8.61 through 8.63
The NVD record does not yet list any specific CPE entries.
Patch Status
NVD's only reference is Oracle's October 2026 Critical Patch Update advisory. Administrators running PeopleTools 8.61–8.63 should check that advisory for fixed versions and patch guidance, then apply the update. Since the attack needs only low-privileged network access, also review who can authenticate to PeopleSoft over HTTP until the patch is in place.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101420
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)