# CERT-FR Advisory: Oracle PeopleSoft Patches

Published: 2026-10-21 · Severity: elevated · Sectors: Government (National), Technology
Canonical: https://vorant.io/reports/76758ae8-75c3-52df-bd7a-d277eae403df/cert-fr-advisory-oracle-peoplesoft-patches

> CERT-FR advises on numerous Oracle PeopleSoft vulnerabilities from Oracle's October 2026 CPU, including remote code execution, DoS, and data exposure flaws.

CERT-FR has published an advisory relaying Oracle's October 2026 Critical Patch Update (cpuoct2026) for multiple PeopleSoft Enterprise components, including PeopleTools (versions 8.61–8.63), HCM Human Resources, FIN Cash Management, SCM Manufacturing/Purchasing/Strategic Sourcing, and several country-specific modules (Argentina, Brazil, Switzerland). The bulletin lists well over one hundred CVEs affecting these products, with risks ranging from remote code execution and remote denial of service to data confidentiality breaches, data integrity compromise, and security policy bypass.

No evidence of in-the-wild exploitation is noted in this advisory; it is a standard vendor patch notification relayed by the French national CERT. Affected organizations running PeopleSoft Enterprise products in the listed version ranges should apply Oracle's official patches referenced in the cpuoct2026 security bulletin as soon as operationally feasible, prioritizing remote code execution and remotely exploitable denial-of-service issues given the breadth of affected modules spanning HR, financials, and supply chain management functions.

Given the large number of CVEs and the diversity of impacted modules — many of which are core ERP/HCM components likely exposed to internal or partner networks — organizations should inventory their PeopleSoft deployments against the affected version list and prioritize patching of PeopleTools given its foundational role across other PeopleSoft modules.

## Mentioned in this report

- Vulnerabilities: CVE-2024-12798, CVE-2024-20925, CVE-2025-15661, CVE-2025-43857, CVE-2025-61772, CVE-2025-61780, CVE-2025-61919, CVE-2026-101388, CVE-2026-101389, CVE-2026-101390, CVE-2026-101407, CVE-2026-101409, CVE-2026-101410, CVE-2026-101411, CVE-2026-101412, CVE-2026-101413, CVE-2026-101414, CVE-2026-101415, CVE-2026-101416, CVE-2026-101417, CVE-2026-101418, CVE-2026-101419, CVE-2026-101420, CVE-2026-101421, CVE-2026-101422, CVE-2026-101423, CVE-2026-101424, CVE-2026-101425, CVE-2026-101426, CVE-2026-101427, CVE-2026-101428, CVE-2026-101429, CVE-2026-101430, CVE-2026-101431, CVE-2026-101432, CVE-2026-101433, CVE-2026-101434, CVE-2026-101435, CVE-2026-101450, CVE-2026-101486

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1352

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/76758ae8-75c3-52df-bd7a-d277eae403df/cert-fr-advisory-oracle-peoplesoft-patches.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup