PeopleSoft PeopleTools CVE-2026-101419

Requires an authenticated low-privilege account on Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) with HTTP network access to the application, and the vulnerable SQR (Structured Query Reporting) component must be reachable/in use. Limiting factors: exploitation is gated by valid authentication (PR:L per CVSS), so pre-auth attackers are excluded; impact is confined to data confidentiality (no integrity or availability effect), and only the 8.61-8.63 version range is affected. No user interaction or non-default configuration is indicated beyond normal use of the SQR reporting functionality.

This is a moderate-priority, not critical, issue. The CVSS 3.1 score of 6.5 reflects a network-exploitable (AV:N), low-complexity (AC:L) flaw requiring only low privileges (PR:L) and no user interaction (UI:N), with impact limited to confidentiality (C:H/I:N/A:N) and no scope change (S:U). Oracle characterizes it as 'easily exploitable,' which aligns with AC:L. However, the PR:L requirement means an attacker needs an existing authenticated low-privilege PeopleTools account - this meaningfully raises the bar versus a true unauthenticated flaw and contradicts the 'Authentication Bypass' tag applied to this record (an actual bypass would be PR:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation or automatable mass-exploitation; exploitation status is 'no public exploit identified at time of analysis.' Net: a genuine but contained information-disclosure risk against authenticated users of a widely-deployed enterprise ERP, warranting prompt patching in Oracle's October 2026 CPU cycle but not emergency out-of-band response absent exploitation signals.

An attacker who already holds a low-privilege PeopleSoft Enterprise PeopleTools account sends crafted HTTP requests to the SQR (Structured Query Reporting) component and leverages the flaw to read data outside their authorization, resulting in unauthorized access to critical or all PeopleTools-accessible data. No user interaction is required and attack complexity is low, but a valid authenticated session is a prerequisite. No public exploit code is identified at the time of analysis.