PeopleSoft PeopleTools CVE-2026-101409

The vulnerable Report Distribution component of PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) must be network-reachable over HTTP by the attacker - typically the PeopleTools web/report tier exposed to a network the attacker can reach. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction are required, and Oracle characterizes it as easily exploitable against affected versions. The primary limiting factors are: (1) the target must be running an affected PeopleTools release (8.61-8.63) with the Report Distribution functionality in use/reachable, and (2) exploitation only yields confidentiality impact (data read), not modification or service disruption. Organizations that restrict PeopleTools web-tier exposure to internal/VPN networks materially reduce the attack surface.

This is a genuine mid-tier priority driven primarily by the clean CVSS vector rather than by confirmed exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is the worst-case combination for exposure: network-reachable over HTTP, low complexity, no privileges, and no user interaction - Oracle itself labels it 'easily exploitable.' However, impact is bounded to confidentiality only (C:H/I:N/A:N), so this is an information-disclosure flaw, not a code-execution or integrity/availability threat, which is why the score lands at 7.5 rather than critical. Critically, several high-signal datapoints are ABSENT from the input: there is no EPSS score, no CISA KEV listing, and no POC indicator, so real-world exploitation probability cannot be quantified from the data provided. Exploitation status is therefore 'no public exploit identified at time of analysis.' A notable conflict exists in the metadata: the 'Authentication Bypass' tag does not align with the described behavior or the CVSS impact set - the vulnerability grants unauthenticated access to data (an information-disclosure outcome), not a bypass that yields authenticated/privileged sessions (which would typically carry integrity impact). Treat the auth-bypass characterization with caution and verify against the Oracle CPU advisory. Overall: a legitimate patch-soon item for PeopleTools operators given the unauthenticated network reach, but the lack of EPSS/KEV/POC means it should not be elevated above confirmed actively-exploited issues competing for the same maintenance window.

A remote, unauthenticated attacker reaches the internet- or intranet-exposed PeopleTools web tier and sends crafted HTTP requests to the Report Distribution component, abusing it to retrieve reports or data they should not be able to access. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker can harvest sensitive PeopleSoft data at scale once the endpoint is discovered. No public exploit code is identified at time of analysis, so exploitation would currently require independent research or reverse-engineering of the Oracle fix.