# Multiple vulnerabilities in Oracle PeopleSoft

Published: 2026-07-23 · Severity: elevated · Sectors: government-national, education, financial-services
Canonical: https://vorant.io/reports/ffbb0314-c365-55b6-8110-0a7692e99a75/multiple-vulnerabilities-in-oracle-peoplesoft

> Oracle PeopleSoft contains multiple vulnerabilities enabling remote denial of service, data confidentiality and integrity breaches.

CERT-FR has published an advisory documenting multiple vulnerabilities affecting Oracle PeopleSoft Enterprise products across versions 8.61, 8.62, and 9.x. The affected systems span a wide range of modules including Human Capital Management (HCM), Financial Management (FIN), Supply Chain Management (SCM), Campus Community, and Common Objects components. These vulnerabilities permit remote attackers to cause denial of service, compromise data confidentiality, and compromise data integrity. The advisory references 71 distinct CVEs with publication dates spanning 2025 and 2026. Organizations running any of the listed PeopleSoft versions should consult Oracle's July 2026 Critical Patch Update bulletin for remediation guidance and apply patches according to the severity and applicability to their deployed modules. The breadth of affected modules indicates this is a significant patching exercise for enterprises reliant on PeopleSoft for HR, financial, and supply chain operations.

## Mentioned in this report

- Vulnerabilities: CVE-2025-55130, CVE-2025-55131, CVE-2025-55132, CVE-2025-59465, CVE-2025-59466, CVE-2025-66021, CVE-2025-68431, CVE-2026-21636, CVE-2026-21637, CVE-2026-21710, CVE-2026-47015, CVE-2026-47017, CVE-2026-47024, CVE-2026-47026, CVE-2026-47048, CVE-2026-47049, CVE-2026-47051, CVE-2026-60152, CVE-2026-60593, CVE-2026-60594, CVE-2026-60595, CVE-2026-60596, CVE-2026-60597, CVE-2026-60598, CVE-2026-60599, CVE-2026-60600, CVE-2026-60601, CVE-2026-60602, CVE-2026-60603, CVE-2026-60604, CVE-2026-60605, CVE-2026-60606, CVE-2026-60607, CVE-2026-60608, CVE-2026-60609, CVE-2026-60610, CVE-2026-60611, CVE-2026-60612, CVE-2026-60613

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0917

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ffbb0314-c365-55b6-8110-0a7692e99a75/multiple-vulnerabilities-in-oracle-peoplesoft.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup