PeopleSoft PeopleTools CVE-2026-101435

Exploitation requires the attacker to already have a low-privileged authenticated logon (PR:L) to the infrastructure/host where PeopleSoft Enterprise PeopleTools executes, and specifically to reach the vulnerable 'Porting' component; the CVSS AV:L means this is local, not remotely reachable over the network without such a foothold. Limiting factors: only PeopleTools versions 8.61 through 8.63 are affected, no remote/unauthenticated path exists, and no user interaction (UI:N) is involved, so a compromised or malicious internal account is the practical precondition. These constraints substantially reduce exposure for environments that tightly control local/application-tier logons.

This is a moderate-severity Oracle-reported vulnerability (CVSS 3.1 base 6.6) whose CVSS vector is internally consistent with the description: AV:L and PR:L confirm that an attacker must already possess a low-privileged logon to the infrastructure where PeopleTools executes, which materially caps real-world risk versus a network-facing unauthenticated flaw. AC:L and the vendor's 'easily exploitable' phrasing agree that no special complexity is needed once that local foothold exists. The dominant impact is A:H (complete, repeatable DOS/hang/crash), with secondary C:L/I:L (read a subset of data; update/insert/delete some data). No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no signal of active or probable near-term exploitation - this looks like a routine Oracle CPU patch item to be scheduled, not an emergency. The main caveat: the only reference is the Oracle October 2026 CPU landing page, not a CVE-specific advisory, so exact affected build boundaries and any workarounds are not independently verifiable from the provided data.

An attacker who already holds a low-privileged account or shell on the server/tier where PeopleTools runs sends crafted input to the vulnerable Porting component, causing a repeatable hang or crash that takes down the application (complete DOS) and, in the same access, reads and tampers with a subset of PeopleTools-accessible data. Because the CVSS vector is AV:L/AC:L, exploitation is straightforward once local logon is obtained, but no public exploit code or active exploitation is identified at time of analysis.