CERT-FR Advisory: Oracle PeopleSoft Patches
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advises on numerous Oracle PeopleSoft vulnerabilities from Oracle's October 2026 CPU, including remote code execution, DoS, and data exposure flaws.
CERT-FR has published an advisory relaying Oracle's October 2026 Critical Patch Update (cpuoct2026) for multiple PeopleSoft Enterprise components, including PeopleTools (versions 8.61–8.63), HCM Human Resources, FIN Cash Management, SCM Manufacturing/Purchasing/Strategic Sourcing, and several country-specific modules (Argentina, Brazil, Switzerland). The bulletin lists well over one hundred CVEs affecting these products, with risks ranging from remote code execution and remote denial of service to data confidentiality breaches, data integrity compromise, and security policy bypass.
No evidence of in-the-wild exploitation is noted in this advisory; it is a standard vendor patch notification relayed by the French national CERT. Affected organizations running PeopleSoft Enterprise products in the listed version ranges should apply Oracle's official patches referenced in the cpuoct2026 security bulletin as soon as operationally feasible, prioritizing remote code execution and remotely exploitable denial-of-service issues given the breadth of affected modules spanning HR, financials, and supply chain management functions.
Given the large number of CVEs and the diversity of impacted modules — many of which are core ERP/HCM components likely exposed to internal or partner networks — organizations should inventory their PeopleSoft deployments against the affected version list and prioritize patching of PeopleTools given its foundational role across other PeopleSoft modules.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1352
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs