CVE-2026-87355: Panel Processor data tampering

CISO Take

CVE-2026-87355 is a medium-severity (CVSS 4.4) flaw in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63. A low-privileged network attacker could, with a victim's interaction, make limited unauthorized changes to data and read a subset of it, with possible impact on other products because of the scope change. This is a general enterprise application flaw, not an AI/ML vulnerability. The AI category assigned to it looks like a misclassification, and no known AI package is affected. Risk is low: the attack complexity is high, user interaction is required, the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and EPSS data is not available. Apply the October 2026 Oracle Critical Patch Update on your normal patch cycle, and prioritize it only if PeopleSoft feeds or integrates with AI/ML pipelines.

Sources:NVDoracle.com

What is the risk?

Low overall risk. CVSS 4.4 reflects high attack complexity, required user interaction, and low confidentiality and integrity impact with no availability impact. There is no known exploitation, no public exploit, no scanner template and no KEV listing. EPSS is unavailable. The scope change means impact could extend beyond PeopleTools, but there is no AI-specific exposure.

How does the attack unfold?

Initial Access

A low-privileged attacker with network access over HTTP targets the PeopleTools Panel Processor component.

User Interaction

The attacker induces another user to take an action, such as clicking a link, that triggers the vulnerability.

Impact

Limited unauthorized data modification and partial data disclosure occur in PeopleTools, with possible effects on other products due to the scope change.

Initial Access

A low-privileged attacker with network access over HTTP targets the PeopleTools Panel Processor component.

User Interaction

The attacker induces another user to take an action, such as clicking a link, that triggers the vulnerability.

Impact

Limited unauthorized data modification and partial data disclosure occur in PeopleTools, with possible effects on other products due to the scope change.

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

Apply the Oracle Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to all PeopleTools 8.61-8.63 instances. Until patched, restrict network access to PeopleSoft web endpoints, train users to avoid unsolicited links and actions in PeopleSoft sessions, and monitor web logs for anomalous Panel Processor requests and unexpected data modifications. Review any downstream AI/ML pipelines that consume PeopleSoft data for integrity validation.

How is it classified?

Data LeakageFramework

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 2.3-Risk treatment and response for identified AI risks

Frequently Asked Questions

What is CVE-2026-87355?

CVE-2026-87355 is a medium-severity (CVSS 4.4) flaw in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63. A low-privileged network attacker could, with a victim's interaction, make limited unauthorized changes to data and read a subset of it, with possible impact on other products because of the scope change. This is a general enterprise application flaw, not an AI/ML vulnerability. The AI category assigned to it looks like a misclassification, and no known AI package is affected. Risk is low: the attack complexity is high, user interaction is required, the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and EPSS data is not available. Apply the October 2026 Oracle Critical Patch Update on your normal patch cycle, and prioritize it only if PeopleSoft feeds or integrates with AI/ML pipelines.

Is CVE-2026-87355 actively exploited?

No confirmed active exploitation of CVE-2026-87355 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87355?

Apply the Oracle Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to all PeopleTools 8.61-8.63 instances. Until patched, restrict network access to PeopleSoft web endpoints, train users to avoid unsolicited links and actions in PeopleSoft sessions, and monitor web logs for anomalous Panel Processor requests and unexpected data modifications. Review any downstream AI/ML pipelines that consume PeopleSoft data for integrity validation.

What systems are affected by CVE-2026-87355?

This vulnerability affects the following AI/ML architecture patterns: Enterprise ERP/HR applications, Data pipelines consuming ERP data.

What is the CVSS score for CVE-2026-87355?

CVE-2026-87355 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

Enterprise ERP/HR applicationsData pipelines consuming ERP data

Compliance Controls Affected

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).

Exploitation Scenario

An authenticated low-privileged attacker crafts a request or content targeting the Panel Processor and persuades another user to interact with it, for example by clicking a link or opening a page. The action executes in the victim's context and allows limited unauthorized insert, update or delete operations and partial data reads. If PeopleSoft data is ingested by AI/ML analytics, the tampered records could taint downstream model inputs, though this is speculative and indirect.