Is CVE-2026-87415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87415 being exploited in the wild.

How severe is CVE-2026-87415?

Medium severity, with a CVSS score of 5.3, published 20 October 2026.

Which products and versions are affected?

Oracle Peoplesoft Enterprise Peopletools 8.61-8.63.

Is there a fix for CVE-2026-87415?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87415 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87415?

Check whether you run Oracle Peoplesoft Enterprise Peopletools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87415: Oracle PeopleSoft Enterprise PeopleTools authorization bypass in Report Distribution

CVE-2026-87415 · Severity: medium · CVSS 5.3 · Published 2026-10-20

Oracle PeopleSoft Enterprise PeopleTools is a business process management and reporting platform used by organizations to manage human capital and enterprise data. An unauthenticated attacker can bypass authorization controls in the Report Distribution component via a network request combined with social engineering, allowing access to sensitive business data without proper credentials. Successful exploitation leads to unauthorized exposure of critical PeopleSoft data that may include employee records, financial information, and other confidential enterprise data.

Technologies: Oracle Peoplesoft Enterprise Peopletools. Vendors: Oracle.

Quick answers

Is CVE-2026-87415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87415 being exploited in the wild.
How severe is CVE-2026-87415?: Medium severity, with a CVSS score of 5.3, published 20 October 2026.
Which products and versions are affected?: Oracle Peoplesoft Enterprise Peopletools 8.61-8.63.
Is there a fix for CVE-2026-87415?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87415 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87415?: Check whether you run Oracle Peoplesoft Enterprise Peopletools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A difficult-to-exploit authorization bypass vulnerability exists in the Report Distribution component of PeopleSoft Enterprise PeopleTools. The vulnerability requires network access and user interaction (phishing or social engineering), but does not require prior authentication. An unauthenticated attacker can gain unauthorized read access to protected data within the PeopleSoft system.

Affected products

Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63

Timeline

2026-10-20: disclosed

References

https://www.oracle.com/security-alerts/cpuoct2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.