# Oracle PeopleSoft gets 100+ CVE patch bundle

Published: 2026-10-21 · Severity: elevated · Sectors: Government (National), Financial Services, Education, Technology
Canonical: https://vorant.io/reports/943e58d5-9136-5929-8300-25d0260dcf83/oracle-peoplesoft-gets-100-cve-patch-bundle

> NCSC-NL flags Oracle's fix for over 100 PeopleSoft Enterprise/PeopleTools vulnerabilities, including unauthenticated network-exploitable flaws up to CVSS 9.8.

NCSC-NL (Dutch national CSIRT) has published an advisory summarizing Oracle's latest patch set for Oracle PeopleSoft Enterprise, covering well over 100 CVEs across PeopleTools and other PeopleSoft modules. The issues span multiple weakness classes including path traversal, out-of-bounds read, incorrect buffer size calculation, improper cryptographic signature verification, improper integrity check validation, and unconstrained resource allocation leading to denial of service. Impact ranges from unauthorized data access and data modification to full system availability disruption, with some flaws exploitable remotely without authentication and others requiring local access, authentication, or additional preconditions.

Severity varies widely per CVE (CVSS v3/v4 scores from under 2.0 up to 9.8), with the most critical entries — CVE-2026-33466 (9.8), CVE-2026-101420 (9.6), CVE-2026-55200 (9.2 v4), CVE-2026-91478 (8.8) and several others above 8.0 — representing network-exploitable, low-complexity issues that warrant prioritized patching. The advisory does not report active exploitation in the wild; it is a routine vendor patch notification rather than an incident report.

Defenders running Oracle PeopleSoft Enterprise/PeopleTools should apply Oracle's updates referenced in this advisory as soon as possible, prioritizing instances exposed to untrusted networks and components tied to the highest-severity CVEs. Given the volume and severity spread, organizations should inventory affected PeopleTools versions and components, confirm patch applicability, and monitor for anomalous authentication, data access, or availability issues on PeopleSoft systems pending remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101388, CVE-2026-101390, CVE-2026-101409, CVE-2026-101410, CVE-2026-101411, CVE-2026-101416, CVE-2026-101418, CVE-2026-101420, CVE-2026-101421, CVE-2026-101422, CVE-2026-101426, CVE-2026-101427, CVE-2026-101428, CVE-2026-101429, CVE-2026-101431, CVE-2026-101434, CVE-2026-101435, CVE-2026-101450, CVE-2026-12816, CVE-2026-33466, CVE-2026-55200, CVE-2026-60743, CVE-2026-60869, CVE-2026-60881, CVE-2026-60885, CVE-2026-83427, CVE-2026-87342, CVE-2026-87344, CVE-2026-87349, CVE-2026-87409, CVE-2026-87410, CVE-2026-9076, CVE-2026-91465, CVE-2026-91468, CVE-2026-91478, CVE-2026-91480, CVE-2026-91482, CVE-2026-91519, CVE-2026-91541, CVE-2026-9563

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0439.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/943e58d5-9136-5929-8300-25d0260dcf83/oracle-peoplesoft-gets-100-cve-patch-bundle.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup