Oracle PeopleSoft PeopleTools CVE-2026-101416

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware running PeopleSoft Enterprise PeopleTools (CVSS AV:A) - it is NOT exploitable from an arbitrary remote/internet location. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attack is explicitly 'difficult to exploit' (AC:H), meaning success depends on specific conditions outside the attacker's direct control (e.g., timing, race, or environmental state) that must be present at the targeted PsAdmin component. Affected deployments are limited to PeopleTools versions 8.61 through 8.63. The primary limiting factors are the adjacency requirement and the high attack complexity; network segmentation that isolates PeopleTools hosts from untrusted local peers substantially reduces real-world exposure.

This is a genuinely high-impact but conditionally-exploitable flaw, and the signals point toward moderate real-world priority rather than an emergency. The CVSS 3.1 base score of 7.5 is driven by total compromise (C:H/I:H/A:H - described as full 'takeover' of PeopleTools), but two metrics sharply constrain it: AV:A means the attacker must be on the same physical/adjacent communication segment as the hardware (not routable from the internet), and AC:H means a successful attack requires specific, hard-to-control conditions. PR:N (no authentication) and UI:N (no user interaction) raise exposure somewhat, but the adjacency + high-complexity combination makes opportunistic mass exploitation unlikely. No EPSS score was supplied, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC in the provided data, so per precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net: a real vulnerability worth patching in the next maintenance window for internal/trusted-segment PeopleTools hosts, but not the drop-everything profile of an unauthenticated network RCE. Note one labeling tension to verify: the Tags list only 'Information Disclosure,' yet the description and CVSS assert full integrity and availability compromise ('takeover') - the tag understates impact; treat the CVSS CIA=H as authoritative.

An attacker positioned on the same local network segment as a PeopleSoft Enterprise PeopleTools server (e.g., a malicious insider, or an adversary who has already gained a foothold on an adjacent host in the data-center VLAN) sends specially crafted traffic to the PsAdmin component. By meeting the specific timing/configuration conditions required (AC:H), the unauthenticated attacker triggers the flaw and escalates to full takeover of PeopleTools. No public exploit code is identified at the time of analysis, so this would require original exploit development.