PeopleSoft PeopleTools CVE-2026-101418

Requires the Report Distribution component of PeopleSoft Enterprise PeopleTools 8.61-8.63 to be network-reachable over HTTP, and the attacker must hold valid low-privilege credentials to the PeopleSoft application (PR:L) - it is NOT exploitable by a fully unauthenticated outsider. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the exploit is reliable. The limiting factors are the authentication requirement and the restriction to versions 8.61-8.63; impact is confined to reading data (C:H), with no ability to alter data or affect availability.

This is a moderate-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring low-level authentication (PR:L) and no user interaction, with impact limited entirely to confidentiality (C:H; I:N/A:N) - an attacker can read critical data but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active or probable near-term exploitation; the only signals are Oracle's own CVSS and its description of the flaw as 'easily exploitable.' NOTE A CONFLICT: the input Tag labels this 'Authentication Bypass,' yet both the description ('low privileged attacker') and the vector (PR:L) require the attacker to already be authenticated - this is a privileged-user confidentiality exposure, not a true pre-auth bypass; verify intent with Oracle's CPU October 2026 advisory. Because exploitation needs valid credentials, realistic risk concentrates on environments with many semi-trusted users (e.g., self-service HR/ERP portals) where credential sprawl makes the 'low privilege' barrier shallow.

A low-privileged but authenticated user of a PeopleSoft portal sends crafted HTTP requests to the Report Distribution component and retrieves reports or data they are not authorized to view, resulting in disclosure of sensitive HR, financial, or payroll information. No public exploit code was identified at time of analysis, and the low attack complexity means the request sequence is straightforward once valid credentials are held.