PeopleSoft PeopleTools CVE-2026-101412

Exploitation requires the attacker to already have an authenticated low-privilege logon (PR:L) to the infrastructure/host where PeopleSoft Enterprise PeopleTools executes - this is local access (AV:L), not a network-reachable path. The vulnerable surface is specifically the Analytic Server component of PeopleTools versions 8.61 through 8.63; environments running other versions or without that component exposed are not affected. High attack complexity (AC:H) means exploitation also depends on specific runtime conditions outside the attacker's control that must be met for the attack to succeed. No end-user interaction is required (UI:N). The combination of mandatory local foothold, valid credentials, and high-complexity preconditions are the key limiting factors that reduce realistic risk well below what a 5.8 base score alone might suggest.

This is a moderate-severity, low-priority issue for most defenders despite its ERP context. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L, base 5.8) describes a vulnerability requiring LOCAL access (the attacker must have logon to the infrastructure where PeopleTools executes), LOW but valid privileges (PR:L - authenticated), and HIGH attack complexity (AC:H - conditions outside the attacker's control must be met). These three factors together substantially constrain real-world exploitability: there is no remote, unauthenticated, or drive-by path. The dominant impact is integrity (I:H - unauthorized creation, deletion, or modification of critical data), with only limited confidentiality (C:L) and partial availability (A:L) effects. No EPSS score, KEV listing, or public POC was provided in the input, so there is no available signal of active exploitation or weaponization; all exploitation-likelihood signals are either absent or point low. There is no conflict among the signals - they consistently indicate a low-to-moderate real-world risk that becomes relevant primarily where an attacker already holds an authenticated local foothold. The 'Denial Of Service' tag overstates the DoS dimension, which is only partial (A:L) and secondary to the integrity impact; treat this primarily as a data-integrity risk, not a DoS risk.

An attacker who already holds a low-privileged authenticated account on a server hosting PeopleSoft Enterprise PeopleTools abuses a flaw in the Analytic Server component to gain unauthorized write access, modifying or deleting critical PeopleTools data. Because the CVSS vector specifies local access (AV:L) and high complexity (AC:H), the attacker needs an existing foothold and must satisfy specific runtime conditions, so this is a privilege-abuse/insider-style scenario rather than a remote mass-exploitation one. No public exploit code was identified at time of analysis.