PeopleSoft PeopleTools CVE-2026-101389

Exploitation requires network HTTP access to the PeopleSoft Enterprise PeopleTools Business Interlink component on affected versions 8.61 through 8.63; no authentication (PR:N) and no user interaction (UI:N) are needed. The key limiting factor is high attack complexity (AC:H) - the attacker must satisfy conditions beyond their direct control or achieve precise/repeatable triggering, so the crash is not trivially reliable. Realistic risk is bounded by whether the PeopleTools/Business Interlink interface is actually network-reachable (e.g., internet-facing vs. internal-only), and impact is availability-only (hang or complete DoS) with no confidentiality or integrity consequence. Deployments that restrict Business Interlink exposure to trusted internal networks sharply reduce practical exploitability.

This is a moderate-severity, availability-only flaw whose signals point to a low real-world priority. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows the one genuinely aggravating factor - network reach without authentication (AV:N, PR:N) - is offset by high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control or requires non-trivial effort/timing. Impact is confined to availability (C:N/I:N): the best outcome for an attacker is a hang or repeatable crash (complete DoS) of PeopleTools, with no data disclosure or integrity loss and no scope change (S:U). No EPSS score, CISA KEV listing, SSVC decision, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; absence of these is not proof of safety but does argue against urgency. Net: a genuine but limited DoS issue appropriate for routine patch-cycle remediation (Oracle October 2026 CPU) rather than emergency action - unless the affected PeopleTools instance is internet-exposed and business-critical, in which case prioritize given the unauthenticated network vector.

A remote, unauthenticated attacker with network access reaches the Business Interlink component over HTTP and sends specially crafted requests designed to trigger the flaw, causing PeopleTools to hang or crash and producing a complete denial of service. Because the CVSS vector specifies high attack complexity (AC:H), the attacker likely needs specific conditions, repeated attempts, or precise timing to reliably trigger the crash. No public exploit identified at time of analysis.