Oracle PeopleSoft gets 100+ CVE patch bundle
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
NCSC-NL flags Oracle's fix for over 100 PeopleSoft Enterprise/PeopleTools vulnerabilities, including unauthenticated network-exploitable flaws up to CVSS 9.8.
NCSC-NL (Dutch national CSIRT) has published an advisory summarizing Oracle's latest patch set for Oracle PeopleSoft Enterprise, covering well over 100 CVEs across PeopleTools and other PeopleSoft modules. The issues span multiple weakness classes including path traversal, out-of-bounds read, incorrect buffer size calculation, improper cryptographic signature verification, improper integrity check validation, and unconstrained resource allocation leading to denial of service. Impact ranges from unauthorized data access and data modification to full system availability disruption, with some flaws exploitable remotely without authentication and others requiring local access, authentication, or additional preconditions.
Severity varies widely per CVE (CVSS v3/v4 scores from under 2.0 up to 9.8), with the most critical entries — CVE-2026-33466 (9.8), CVE-2026-101420 (9.6), CVE-2026-55200 (9.2 v4), CVE-2026-91478 (8.8) and several others above 8.0 — representing network-exploitable, low-complexity issues that warrant prioritized patching. The advisory does not report active exploitation in the wild; it is a routine vendor patch notification rather than an incident report.
Defenders running Oracle PeopleSoft Enterprise/PeopleTools should apply Oracle's updates referenced in this advisory as soon as possible, prioritizing instances exposed to untrusted networks and components tied to the highest-severity CVEs. Given the volume and severity spread, organizations should inventory affected PeopleTools versions and components, confirm patch applicability, and monitor for anomalous authentication, data access, or availability issues on PeopleSoft systems pending remediation.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0439.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,774 reports from 143 sources, 495 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs