☕ This Week’s Focus
Oracle’s RECONNECT recap had one line I’d put on every PeopleSoft team’s list: check what you run for components Oracle no longer supports, because Oracle isn’t scanning or patching them.
On November 3, Oracle published its write-up of RECONNECT Dive Deep. Most of it is roadmap: a new leader for the PeopleSoft business, Premier Support through at least 2037, two Taskflow monitors due by the end of 2026, and planned REST services to feed AI tools. The security section is short. It says the parts of your stack that have fallen out of support are no longer being scanned or patched by Oracle.
The October CPU only covers what Oracle still supports. That makes your support inventory a security control.
Let’s get into it.
🧰 What Oracle Said After RECONNECT
🔗 RECONNECT Dive Deep 2026 and the Priorities Shaping PeopleSoft Investment (Oracle / Russell Broom) https://blogs.oracle.com/peoplesoft/reconnect-dive-deep-2026-and-the-priorities-shaping-peoplesoft-investment
November 3. The virtual conference drew registrations from more than 2,095 customers representing 123 organizations, plus 51 partners. Alex Man, Group Vice President of Application Development, now leads Oracle’s PeopleSoft business, following Paco Aubrejuan’s retirement after 18 years. His stated priorities: keep improving the systems customers run today (he named PS/Query, Classic pages, Tree Manager and nVision), make AI practical, and help customers plan their Oracle applications future, including evaluating Fusion, “alongside continued PeopleSoft investment, backed by Premier Support through at least 2037.”
Two dated items: the Taskflow Framework’s first applications, Period Close Monitor for FSCM and Payroll Monitor for HCM, are “planned for delivery by the end of 2026.” And the security patching roadmap lists patch visibility, more predictable patching, more automation and environment health assessments.
My read: The Fusion line will get the attention. The line I’d act on is in the security section: “Customers should also periodically review the products and features they use for components that are no longer supported, because those areas are no longer being scanned or patched by Oracle.” Oracle doesn’t usually say that so directly. Thursday’s Q&A covers where to look.
🔐 Security: A Slow Week for PeopleSoft, a Busy One for Java
🔗 Oracle Security Alert: CVE-2026-114820 (Oracle) https://www.oracle.com/security-alerts/alert-cve-2026-114820.html
🔗 Distrusting eMudhra Intermediate Certificates in Oracle JDK (Oracle) https://ops.java/emudhra
Oracle released this alert October 24 and expanded it October 30 to cover Oracle Database Server and OPatch. The issue: the private keys of eight eMudhra intermediate CA certificates were compromised, so Oracle removed the related root certificates from the JDK keystore. The fix is a Java update. If you can’t patch yet, Oracle documents deleting four root aliases from cacerts with keytool and restarting the runtime, or turning on revocation checking.
🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/
The October CPU moved to Rev 3 on November 4 (a credit added, no new patches). The next Critical Security Patch Update is November 17, then December 15. The next quarterly CPU is January 19, 2027. CISA’s exploited-vulnerabilities catalog added no Oracle entries this week. The newest Oracle entry is still the WebLogic proxy plug-in flaw from August 24.
My read: PeopleSoft carries its own Java in the DPK, so this alert applies to you even though “PeopleSoft” doesn’t appear in it. A Java update in the middle of a quarter changes your trust store, so check outbound TLS from Integration Broker in non-prod before the update reaches production. The November 17 CSPU is eight days out. Decide now whether it gets a window.
🤖 Agents in ERP
This week: Oracle said where PeopleSoft’s AI work is headed, and the 8.63 documentation shows how an agent signs in.
Oracle’s November 3 recap says its AI investment “focuses on AI infrastructure rather than embedding AI directly into the applications.” It names the PeopleTools MCP server and planned REST services for core business objects, to connect AI tools “with appropriate security and controls.” On November 6 Oracle also listed a December 2 webinar on the PeopleTools 8.63 AI components.
The 8.63 documentation fills in the sign-in. The MCP server’s get_psft_auth_token tool takes a CLIENT_ID, a CLIENT_SECRET and an authentication URL, and returns a PSTOKEN. The agent then calls Application Services APIs, which apply the business logic and security you already have.
So the agent works with whatever access that client ID has. Wednesday on LinkedIn, the Agents in ERP post covers the secret behind it: where it’s stored, who can read it, and who rotates it.
🔗 https://docs.oracle.com/en/applications/peoplesoft/peopletools/8.63/portal-technology/working-mcp-tools.html 🔗 https://docs.oracle.com/en/applications/peoplesoft/peopletools/8.63/portal-technology/understanding-mcp-server.html
💬 Aaron’s Take
There’s no new PeopleSoft fire this week, so it’s a good week to check the parts of the stack that don’t get patched.
Write down your PeopleTools release and its support dates. Oracle’s policy gives a minor release full patches until 12 months after the next release ships, then up to 12 more months of critical patches only.
Check the Java in every DPK and runtime against the eMudhra alert, and test Integration Broker connections in non-prod after the update.
Decide on November 17 now. Either the CSPU gets a window or someone writes down why it waits.
If anyone is piloting the 8.63 MCP server, find out whose ID the
CLIENT_IDmaps to and who holds the secret.
Thursday’s Q&A: Oracle told PeopleSoft customers to check for components it no longer patches. Where do you look first? Got a PeopleSoft question of your own? Reply to this email.
🌐 Join the Community
Subscribe to PeopleSoft Cloud at peoplesoftcloud.com for the Monday Digest and the Thursday Q&A. No vendor spin, just what changed and what to do about it.
✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Thursday: one real PeopleSoft question, answered straight ✅ Written by a practitioner who still has to make the change window