CVE-2025-8386

MediumCVSS 6.9

Published: 15/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

Vulnerability in the IDE component of Application Server, which when exploited by an authenticated attacker with 'aaConfigTools' privilege, can allow tampering with App Objects' help files and persist a cross-site scripting (XSS) injection. The attack can lead to horizontal or vertical privilege escalation when executed by a victim.

Risk Assessment

Risk of privilege escalation within the Application Server environment, potentially leading to unauthorized access to critical functions.

Recommendation

Restrict access to configuration operations in the IDE and apply patches provided by the vendor.

Other vulnerabilities in Application Server

CVE-2026-35276High
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle, affecting the application server component. Supported versions 8.61 and 8.62 are vulnerable, allowing an unauthenticated attacker to remotely take control of the system.

Original NVD description (English source)

The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS