PeopleSoft PeopleTools CVE-2026-101433

Exploitation requires network HTTP access to the PeopleSoft Enterprise PeopleTools web tier with the Test Framework component reachable, against PeopleTools versions 8.61 through 8.63; per the Oracle-supplied vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is stated as necessary. The principal limiting factors are that the PeopleTools web endpoint (and specifically the Test Framework) must be network-exposed to the attacker rather than restricted to an internal/management network, and the outcome is capped at read access to a subset of data (C:L, no integrity or availability impact), so it cannot be leveraged for modification or service disruption.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) whose vector - AV:N/AC:L/PR:N/UI:N - describes a genuinely easy, remote, unauthenticated, no-interaction attack over HTTP, which is the main factor elevating it above a trivial issue. However, the impact is deliberately narrow: C:L with I:N/A:N means only unauthorized read access to a subset of PeopleTools-accessible data, with no integrity or availability consequence and no scope change (S:U). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, low-effort exposure worth patching in the normal Oracle CPU cycle, but not an emergency - the low confidentiality-only impact keeps real-world risk well below what the 'easily exploitable / unauthenticated' language might suggest. Note a signal conflict: the input Tag 'Authentication Bypass' does not match the Oracle description, which characterizes the issue as unauthorized read of a data subset rather than a bypass of authentication - treat the tag with skepticism and rely on the Oracle advisory.

An unauthenticated attacker with network reach to the PeopleSoft web tier sends a crafted HTTP request to the exposed Test Framework component and receives back a subset of PeopleTools-accessible data they should not be able to read. No credentials, user interaction, or special timing are required, consistent with AV:N/AC:L/PR:N/UI:N. No public proof-of-concept was identified in the provided data.