PeopleSoft PeopleTools CVE-2026-101425

Exploitation requires an authenticated low-privileged account with logon access to the server infrastructure where PeopleSoft Enterprise PeopleTools executes (AV:L, PR:L), specifically targeting the SQR reporting component on affected versions 8.61 through 8.63. The high attack complexity (AC:H) indicates the attacker must meet conditions outside their direct control - not a simple, repeatable action - which meaningfully limits realistic exploitation. No user interaction is needed (UI:N), but network-remote and unauthenticated exploitation are NOT possible, and impact is confined to unauthorized read access to a subset of data (no write/modify or availability effect).

This is a low-priority vulnerability by every available signal. The CVSS 3.1 base score is 2.5 (Low) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires local logon to the infrastructure where PeopleTools runs, high attack complexity, and existing low-level privileges, yielding only limited confidentiality impact (read access to a subset of data) with no integrity or availability impact. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no conflict between the CVSS vector and the description - both consistently indicate an authenticated, local, difficult-to-exploit information-disclosure issue. The one data discrepancy worth noting is the 'Authentication Bypass' tag, which contradicts the vulnerability's actual nature: this flaw REQUIRES an authenticated low-privileged account (PR:L) and does not bypass authentication, so that tag appears mislabeled. Bottom line: a genuinely low real-world risk, not a high-CVSS-but-overstated issue.

A low-privileged user who already holds a valid logon to the server infrastructure hosting PeopleSoft Enterprise PeopleTools abuses the SQR component to read a limited subset of data they are not authorized to see. Because attack complexity is high (AC:H), the attacker must satisfy specific, hard-to-control conditions, making opportunistic exploitation unlikely. No public exploit code was identified at time of analysis.