PeopleSoft PeopleTools CVE-2026-101429

Exploitation requires the attacker to first have a local logon account on the infrastructure/host where PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) executes - this is a local-access precondition (AV:L), not network-facing, despite PR:N indicating no PeopleSoft application authentication is needed. It specifically targets the SQR (Structured Query Reporting) component. Two concrete limiting factors reduce real-world risk: Oracle rates it high-complexity ('difficult to exploit,' AC:H), and successful attacks require human interaction from a person other than the attacker (UI:R) - meaning a separate legitimate user must perform some action (e.g. running or processing the crafted report) for the attack to succeed. Only PeopleTools 8.61-8.63 are affected.

This is a genuinely moderate-priority issue that should not be treated as an urgent, mass-exploitation threat despite its 7.0 'High' CVSS score. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally revealing: while PR:N nominally means no privileges, the Oracle description clarifies this means an 'unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes' - i.e. the attacker already needs local access to the host, reflected in AV:L (local attack vector), not network reachability. Two strong mitigating factors are baked into the score: AC:H (high attack complexity - Oracle explicitly calls this a 'difficult to exploit vulnerability') and UI:R (success 'requires human interaction from a person other than the attacker'). The payoff if those conditions are met is severe: full takeover with C:H/I:H/A:H. On the exploitation-signal side there is no CISA KEV listing, no EPSS score provided, and no public proof-of-concept in the supplied data, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The combination of local vector, high complexity, and required third-party interaction makes automated or widespread exploitation unlikely, pointing toward a low-probability, high-impact profile best handled on a normal quarterly-patch cadence rather than emergency response. Note one labeling inconsistency to verify: the input Tags mark this 'Information Disclosure,' yet the CVSS vector and description describe full takeover (I:H/A:H), so the tag understates impact.

An attacker who already possesses a local logon on the server hosting PeopleSoft Enterprise PeopleTools stages malicious content targeting the SQR (Structured Query Reporting) component, then waits for a legitimate operator or user to process or run the affected report, which triggers the flaw. Because exploitation is rated high-complexity (AC:H) and depends on action by another person (UI:R), it is not a point-and-click remote attack. No public exploit code was identified in the provided data.