Oracle PeopleSoft Patches Dozens of Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR flags multiple Oracle PeopleSoft vulnerabilities, some allowing remote code execution, DoS, and data exposure, per Oracle's October 2026 CPU.
CERT-FR has published an advisory relaying Oracle's October 2026 Critical Patch Update (cpuoct2026), which addresses a large number of vulnerabilities across multiple Oracle PeopleSoft Enterprise modules. Affected components include PeopleTools (versions 8.61 to 8.63), HCM Human Resources, FIN Cash Management, SCM Manufacturing, SCM Purchasing, SCM Strategic Sourcing, CC Common Application Objects, and several country-specific FIN and HCM modules for Argentina, Brazil, and Switzerland, all at version 9.1 or 9.2.
The vulnerabilities collectively allow an attacker to achieve remote code execution, trigger remote denial of service, compromise data confidentiality and integrity, and bypass security controls. The advisory does not indicate that any of these flaws are being actively exploited in the wild; it is a standard patch notification tied to Oracle's quarterly Critical Patch Update cycle rather than a report of observed attack activity.
No detailed technical analysis, proof-of-concept, or exploitation details are provided in the advisory itself — it simply enumerates affected products and references well over 100 CVE identifiers from Oracle's bulletin. Defenders running PeopleSoft Enterprise deployments, particularly those exposed to the internet or used for HR/financial operations, should apply Oracle's official patches referenced in the cpuoct2026 bulletin as a priority, prioritizing any components permitting remote code execution or confidentiality impact.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1352
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,960 reports from 143 sources, 519 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs