PeopleSoft PeopleTools CVE-2026-101420

Exploitation requires network access over HTTP to the SQR (Structured Query Reporter) component of PeopleSoft Enterprise PeopleTools, versions 8.61 through 8.63 specifically. The attacker MUST hold valid low-privilege credentials (CVSS PR:L) - this is not an unauthenticated flaw despite the 'Authentication Bypass' tag - but no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The scope change (S:C) means successful exploitation reaches beyond PeopleTools into additional connected products. Limiting factors for defenders: the requirement for a valid authenticated account bounds exposure to users who can obtain credentials (insiders, phished/compromised accounts, or broadly-provisioned portals); environments outside the 8.61-8.63 version band are not affected; and internet-exposed PeopleSoft portals materially increase realistic risk.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N = 9.6) describes a network-reachable, low-complexity flaw in the SQR component of Oracle PeopleSoft Enterprise PeopleTools that requires only low privileges, no user interaction, and crucially involves a scope change (S:C) with high confidentiality and integrity impact - meaning a modestly privileged user can read, create, delete, or modify all PeopleTools-accessible data and impact adjacent products. Several key exploitation signals are MISSING from the provided data: no EPSS probability score is supplied, so real-world exploitation likelihood cannot be quantified; KEV status is absent, so this is NOT confirmed as actively exploited; and no POC/exploit code is referenced. Thus the risk rests on the intrinsic severity of the flaw rather than any evidence of exploitation in the wild. CONFLICT TO VERIFY: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which specifies PR:L (a low-privileged authenticated attacker) - an authentication bypass would imply PR:N. The description and vector both indicate authentication IS required, so the 'Authentication Bypass' label appears mislabeled and should be verified against Oracle's advisory. Because exploitation needs valid (if low) credentials, realistic risk is highest in environments where PeopleSoft accounts are broadly provisioned or where credential theft/phishing is feasible.

A low-privileged but authenticated PeopleSoft user (or an attacker who has obtained any valid low-tier credential) sends a crafted HTTP request to the vulnerable SQR component of PeopleTools. Because exploitation is low-complexity and causes a scope change, the attacker escalates to read, alter, or delete all PeopleTools-accessible data and may impact adjacent products. No public exploit code is referenced at the time of analysis, and there is no confirmation of active exploitation.