# Oracle PeopleSoft Patches Dozens of Flaws

Published: 2026-10-21 · Severity: elevated · Sectors: Government (National), Financial Services, Manufacturing
Canonical: https://vorant.io/reports/d7acea9a-ed4a-5baf-985e-c2c56e9e6f0e/oracle-peoplesoft-patches-dozens-of-flaws

> CERT-FR flags multiple Oracle PeopleSoft vulnerabilities, some allowing remote code execution, DoS, and data exposure, per Oracle's October 2026 CPU.

CERT-FR has published an advisory relaying Oracle's October 2026 Critical Patch Update (cpuoct2026), which addresses a large number of vulnerabilities across multiple Oracle PeopleSoft Enterprise modules. Affected components include PeopleTools (versions 8.61 to 8.63), HCM Human Resources, FIN Cash Management, SCM Manufacturing, SCM Purchasing, SCM Strategic Sourcing, CC Common Application Objects, and several country-specific FIN and HCM modules for Argentina, Brazil, and Switzerland, all at version 9.1 or 9.2.

The vulnerabilities collectively allow an attacker to achieve remote code execution, trigger remote denial of service, compromise data confidentiality and integrity, and bypass security controls. The advisory does not indicate that any of these flaws are being actively exploited in the wild; it is a standard patch notification tied to Oracle's quarterly Critical Patch Update cycle rather than a report of observed attack activity.

No detailed technical analysis, proof-of-concept, or exploitation details are provided in the advisory itself — it simply enumerates affected products and references well over 100 CVE identifiers from Oracle's bulletin. Defenders running PeopleSoft Enterprise deployments, particularly those exposed to the internet or used for HR/financial operations, should apply Oracle's official patches referenced in the cpuoct2026 bulletin as a priority, prioritizing any components permitting remote code execution or confidentiality impact.

## Mentioned in this report

- Vulnerabilities: CVE-2024-12798, CVE-2024-20925, CVE-2025-15661, CVE-2025-43857, CVE-2025-61772, CVE-2025-61780, CVE-2025-61919, CVE-2026-101388, CVE-2026-101389, CVE-2026-101390, CVE-2026-101407, CVE-2026-101409, CVE-2026-101410, CVE-2026-101411, CVE-2026-101412, CVE-2026-101413, CVE-2026-101414, CVE-2026-101415, CVE-2026-101416, CVE-2026-101417, CVE-2026-101418, CVE-2026-101419, CVE-2026-101420, CVE-2026-101421, CVE-2026-101422, CVE-2026-101423, CVE-2026-101424, CVE-2026-101425, CVE-2026-101426, CVE-2026-101427, CVE-2026-101428, CVE-2026-101429, CVE-2026-101430, CVE-2026-101431, CVE-2026-101432, CVE-2026-101433, CVE-2026-101434, CVE-2026-101435, CVE-2026-12816, CVE-2026-22860

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1352

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d7acea9a-ed4a-5baf-985e-c2c56e9e6f0e/oracle-peoplesoft-patches-dozens-of-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup