PeopleSoft Enterprise PeopleTools CVE-2026-101428

Exploitation requires the SQR (Structured Query Reporter) component of PeopleSoft Enterprise PeopleTools to be reachable over HTTP, and the target must be running an affected version in the 8.61-8.63 range. The attacker must hold valid low-privileged credentials (PR:L) - this is not an unauthenticated flaw - but no victim user interaction is needed (UI:N). The key limiting factor is the high attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit,' implying success depends on conditions outside the attacker's direct control (e.g., specific SQR configurations, timing, or environmental state) rather than a deterministic single request. Realistic risk is therefore gated by (1) possession of an authenticated account and (2) the difficulty of reliably meeting the exploit preconditions.

This is a genuinely serious but not top-tier-urgent vulnerability. The CVSS 3.1 base score of 7.5 reflects a combination that pulls in opposite directions: the attack vector is network (AV:N) over HTTP and requires no user interaction (UI:N), but exploitation is explicitly rated high-complexity (AC:H) and requires a low-privileged authenticated account (PR:L). Oracle's own wording - 'Difficult to exploit vulnerability allows low privileged attacker' - is fully consistent with AC:H/PR:L. The impact is maximal (C:H/I:H/A:H, full 'takeover of PeopleSoft Enterprise PeopleTools'), which is what drives the score up despite the exploitation friction. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is therefore moderate-to-high for organizations running the affected PeopleTools 8.61-8.63 SQR component: the need for valid credentials plus high attack complexity meaningfully limits mass/opportunistic exploitation, but any authenticated user (including a compromised low-privilege account) achieving full takeover makes this a strong candidate for prompt patching in the Oracle October 2026 CPU cycle. Missing signals to note explicitly: EPSS probability is absent (cannot quantify likelihood), and KEV/POC status is unconfirmed rather than confirmed-negative.

An attacker who already holds a low-privileged PeopleSoft account (e.g., a standard business user, or a credential obtained via phishing) sends crafted HTTP requests that reach the SQR reporting component of PeopleTools. By exploiting the flaw in SQR processing, the attacker escalates from limited access to full compromise of the PeopleTools environment. No public exploit identified at time of analysis, and the high attack complexity (AC:H) means exploitation likely requires specific conditions or timing rather than a single reliable request.