PeopleSoft PeopleTools CVE-2026-101413

Exploitation requires (1) network HTTP access to the PeopleSoft Enterprise PeopleTools Analytic Server component, and (2) valid low-privileged authentication to the PeopleSoft application (PR:L) - it is NOT reachable by an unauthenticated attacker. The CVSS AC:H rating indicates additional limiting conditions: successful attacks depend on circumstances the attacker cannot fully control (e.g., specific server state, timing, or repeated attempts), so reliable triggering is non-trivial. Only PeopleTools versions 8.61 through 8.63 are affected, and impact is limited to availability (hang or repeatable crash / complete DOS) with no data disclosure or modification. Deployments that restrict Analytic Server exposure to trusted internal networks and tightly control application account issuance materially reduce realistic risk.

This is a moderate, availability-only issue (CVSS 3.1 base 5.3, A:H with C:N/I:N) best characterized as a denial-of-service rather than a confidentiality/integrity threat. Key mitigating signals converge: AC:H means exploitation is difficult (special conditions or timing/race factors the attacker does not control), and PR:L requires the attacker to already hold valid low-privileged PeopleSoft credentials, so this is not an unauthenticated internet drive-by despite AV:N. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was referenced - all three exploitation-probability signals are therefore absent or negative, consistent with a vendor-reported (Oracle secalert) flaw disclosed through the October 2026 Critical Patch Update rather than an in-the-wild threat. SSVC-style framing: exploitation status is 'none', technical impact is partial (availability loss only), and automatability is low given the authentication requirement and high attack complexity. Net: this is a real but low-priority bug - patch it in the normal Oracle CPU cycle, not as an emergency. The only notable caveat is that a DoS against an ERP/analytics tier can still be operationally disruptive in a production environment, so internet-exposed or multi-tenant PeopleSoft deployments should prioritize it over purely internal ones.

An attacker who already holds a low-privileged PeopleSoft application account sends crafted HTTP requests to the Analytic Server component to trigger a condition that hangs or repeatably crashes PeopleTools, producing a complete denial of service. Because the CVSS vector specifies high attack complexity (AC:H), the attacker likely needs specific conditions or repeated attempts to reliably trigger the fault. No public proof-of-concept exploit was identified in the provided data.