CVE-2017-3546

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.06.5Medium EPSS percentile95th9.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2017-04-24Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Oracle Corporation PeopleSoft Enterprise PT PeopleToolsAffected: 8.54Upgrade to: not statedAffected: 8.55Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you are running Oracle PeopleSoft Enterprise PT PeopleTools (PeopleTools) version 8.54 or 8.55, and whether the MultiChannel Framework is enabled and reachable over HTTP.
If you are on an affected version (8.54 or 8.55), plan an upgrade using the vendor’s PeopleSoft CPU/Security Advisory referenced for CVE-2017-3546.
Apply the vendor remediation from Oracle’s CPU/Security Advisory for this CVE and verify the PeopleTools MultiChannel Framework is no longer reachable over the public internet unless explicitly required.
After patching, test that the affected endpoint(s) are accessible as expected for legitimate users and that unauthorized actions are not possible (using internal/approved security testing).

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

In plain language

Written by AI from the record

CVE-2017-3546 is a medium-severity PeopleSoft PeopleTools issue in version 8.54 and 8.55 that can let an attacker reach your system over HTTP and make unauthorized changes to certain PeopleSoft data; most small businesses should patch soon if they run PeopleSoft PeopleTools and the affected component is exposed.

In Oracle PeopleSoft Enterprise PT PeopleTools (PeopleTools MultiChannel Framework), CVE-2017-3546 is an unauthenticated, network-reachable weakness that can be triggered over HTTP to allow unauthorized update/insert/delete and partial read access to PeopleTools-accessible data.

If you're affected

Unauthorized data changes
Unauthorized data read access
Potential account/record tampering
Loss of data integrity

What is it

Think of PeopleSoft PeopleTools like the “engine” that helps the system handle requests. In this issue, an attacker who can reach your server over the web (HTTP) without needing a login may be able to make unauthorized edits or view a limited slice of the data the engine exposes.

It’s similar to leaving an admin interface reachable from the street: even if the front door looks locked, a flaw in the building system could let someone tamper with certain records.

Who is affected

This matters if your small business uses Oracle PeopleSoft Enterprise PT PeopleTools running version 8.54 or 8.55, particularly the PeopleTools MultiChannel Framework part. The key risk is for systems where that part is reachable over HTTP from the network.

Because the weakness is unauthenticated and network-reachable over HTTP, you should treat it as relevant when the vulnerable component is exposed to callers over the network (especially from the internet).

How urgent is it

This should be treated as urgent enough to schedule immediately, because a public exploit exists and the predicted likelihood is rising. While this is not confirmed as a known KEV listing, the combination of public exploit availability and direct, unauthenticated HTTP reachability makes it a practical target.

Given the AMBER verdict, patching should be prioritized ahead of normal maintenance windows, especially if your PeopleSoft MultiChannel Framework is exposed over HTTP.

What to do — in detail

Confirm affected software and exposure

Determine whether your PeopleSoft PeopleTools is version 8.54 or 8.55.
Confirm whether the PeopleTools MultiChannel Framework is enabled.
Identify whether the relevant HTTP endpoint(s) are reachable from untrusted networks (for example, the public internet or any external network segment).

Validate the remediation target

Use Oracle’s referenced security advisory remediation for CPUApr2017-3236618 (the vendor remediation is the authoritative fix source in the provided findings).
Map the advisory to your PeopleSoft deployment/patching branch and upgrade path (your PeopleSoft administrator/vendor integrator can confirm the exact patch bundle for your environment).

Upgrade/patch

Upgrade PeopleTools off version 8.54 or 8.55 by applying the Oracle remediation associated with CVE-2017-3546.
After patching, re-check that MultiChannel Framework remains properly configured and that any externally exposed HTTP access is limited to what is required.

Temporary risk reduction if you cannot patch immediately

Restrict network access so that the affected HTTP-reachable interface is not accessible from the public internet.
Allow only the specific IP ranges or network paths needed for your legitimate users/integration partners.
Add monitoring for unexpected requests to the MultiChannel Framework endpoints (use your existing web/app monitoring/logging).

Post-remediation checks

Confirm the system functions normally for legitimate traffic.
Confirm that unauthorized behaviors (update/insert/delete or unauthorized reads tied to the vulnerable component) are not possible via the previously reachable path.

Operational monitoring

Look for exploit-like traffic patterns against PeopleTools endpoints after exposure and after patching (alerts should be driven by your internal SOC/SIEM rules or your web/app logs).

Note: No CISA KEV entry was found for this CVE in the provided findings.

Technical context

Severity is medium by the provided CVSS 6.5 score (Confidentiality and Integrity impacts). The weakness is classified as CWE-918 (server-side request misuse / related improper handling). Attack vector is network-based over HTTP with no required privileges or user interaction, enabling an unauthenticated attacker to trigger unauthorized actions.

Exploitation status: a public exploit is available (weaponization finding). No KEV listing in CISA was found in the provided findings, so KEV-driven urgency is not applicable here.

EPSS (predicted): 9.6% with a rising trend, but this is not a substitute for confirmed exploitation; it supports prioritization.

What to monitor technically: inbound HTTP requests to the PeopleTools MultiChannel Framework surface area, and any indicators of unauthorized update/insert/delete operations or unexpected reads of PeopleTools-accessible data.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

9.6% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

Oracle Corporationcommercial · USaka oracle, oracle corp.
- PeopleSoft Enterprise PT PeopleToolsWeb AppOn-premEnterprise Software / itsm-monitoring
- peoplesoft enterprise peopletoolsWeb AppOn-premEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact