PeopleSoft PeopleTools CVE-2026-101411

Exploitation requires network HTTP access to a PeopleSoft Enterprise PeopleTools 8.61-8.63 instance whose Business Interlink integration component is reachable/in use; no authentication (PR:N) and no user interaction (UI:N) are needed. The principal limiting factor is high attack complexity (AC:H) - Oracle labels it 'Difficult to exploit' - meaning the attacker must meet conditions beyond their control (e.g., specific environmental, configuration, or timing state) for a successful attack, which materially reduces real-world exploitability despite the unauthenticated network vector. Internet-exposed PeopleSoft portals increase reachability risk; instances not exposing the Business Interlink pathway are correspondingly less exposed.

This is a genuinely serious but not top-tier-urgent vulnerability. The CVSS 3.1 base score of 8.1 (High) is driven by network reachability (AV:N), no privileges (PR:N), no user interaction (UI:N), and full compromise of confidentiality, integrity and availability (C:H/I:H/A:H) - Oracle explicitly describes the outcome as 'takeover' of PeopleSoft Enterprise PeopleTools. The single factor holding the score below critical is high attack complexity (AC:H), which Oracle restates in plain language as 'Difficult to exploit.' No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept is referenced (the only source is the Oracle October 2026 Critical Patch Update advisory), so the status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Signals are therefore consistent rather than conflicting: a high-impact, unauthenticated, network-exploitable flaw whose practical risk is tempered by genuine exploitation difficulty and the absence of any public exploit or active-exploitation evidence. Treat it as a high-priority patch within the normal Oracle CPU cycle for exposed PeopleSoft estates, but it does not currently warrant emergency out-of-band response. Note: the EUVD/input Tags label this 'Information Disclosure,' which understates a vulnerability Oracle describes as full takeover with integrity and availability impact - do not scope remediation around data-leak assumptions alone.

An unauthenticated attacker who can reach the PeopleSoft web/integration tier over HTTP sends specially crafted requests against the Business Interlink component to achieve full compromise of the PeopleTools environment. Because attack complexity is high (AC:H), the attacker must satisfy conditions outside their direct control - such as specific timing, configuration, or environmental state - so reliable exploitation is non-trivial. No public exploit code is known at time of analysis, so initial exploitation would likely require original research.