PeopleSoft PeopleTools CVE-2026-101417

Exploitation targets the Tuxedo component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and requires network reachability to the application over HTTP; no authentication (PR:N) and no user interaction (UI:N) are needed. The key LIMITING factor is the High attack complexity (AC:H): the attacker must meet conditions beyond their control - such as winning a race or hitting a specific transient server state - which substantially reduces reliability. Impact is bounded to unauthorized read access to a subset of PeopleTools-accessible data, with no write or availability effect, so the practical consequence is partial information disclosure rather than full compromise. Deployments where the PeopleTools/Tuxedo layer is not exposed to untrusted networks are not reachable by this vector.

This is a low-severity issue (CVSS 3.1 base 3.7) that should be treated as low priority despite being network-reachable and unauthenticated. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N shows the mitigating factors clearly: although the attack vector is network (AV:N) and no privileges or user interaction are required (PR:N/UI:N), attack complexity is High (AC:H), meaning exploitation depends on conditions outside the attacker's control, and the only impact is a Low confidentiality leak (C:L) with no integrity or availability impact (I:N/A:N) and no scope change (S:U). No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no signal of active exploitation - status is no public exploit identified at time of analysis. The signals are internally consistent (a hard-to-exploit, read-only information disclosure) rather than conflicting. Note that the input Tags include 'Authentication Bypass,' which conflicts with the Oracle description and CVSS data: the flaw grants unauthorized read access to a subset of data, not an authentication bypass - this tag appears mislabeled and should not drive prioritization.

An unauthenticated attacker with network access sends specially crafted HTTP traffic to the Tuxedo component of an exposed PeopleSoft Enterprise PeopleTools deployment. Because attack complexity is High, the attacker must win a race condition or satisfy specific runtime conditions, and a successful attempt yields only unauthorized read access to a limited subset of PeopleTools data. No public exploit code is identified at time of analysis.