PeopleSoft Enterprise PeopleTools CVE-2026-101487

Exploitation requires the attacker to hold valid low-privileged credentials on the PeopleSoft Portal (PR:L) and to lure a separate victim user into interacting with attacker-influenced Portal content (UI:R) - it is not a drive-by unauthenticated attack. The affected feature is the Portal component of PeopleTools versions 8.61 through 8.63; environments on other versions or without the Portal exposed to multiple interacting users are not affected. Limiting factors that reduce real-world risk: the mandatory authentication, the dependency on a second human victim taking an action, and the partial (C:L/I:L) rather than full compromise with no availability impact. The scope change (S:C) means successful exploitation can affect data or components beyond the PeopleTools vulnerable component itself.

This is a moderate-severity issue (CVSS 3.1 5.4) best characterized as a priority of limited-to-moderate urgency rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability over HTTP and low attack complexity, but exploitation is gated by two meaningful constraints: the attacker needs low-level authenticated privileges (PR:L) and must induce interaction from a different victim user (UI:R). The scope change (S:C) combined with partial confidentiality and integrity impact (C:L/I:L, A:N) and the Portal component strongly fits a stored/reflected cross-site scripting pattern where attacker-planted content executes in another user's authenticated session. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation - treat exploitation probability as unestablished rather than confirmed-low. Note a conflict in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS, which requires authentication (PR:L) and user interaction and reflects a scope-change XSS-style impact, not an auth bypass - the tag should be verified against the Oracle advisory. Overall this warrants patching in a normal Oracle Critical Patch Update cycle, prioritized above A:N informational issues but below unauthenticated RCE.

A low-privileged authenticated PeopleSoft user plants a malicious payload (e.g., crafted content in a Portal field or page) that is later rendered to a higher-privileged user such as an administrator. When that victim views the affected Portal page, the payload executes in their authenticated browser context, allowing the attacker to read and modify a subset of data accessible to the victim across the scope-changed boundary. No public exploit code was identified at time of analysis, and success depends on the victim actually interacting with the attacker-controlled content.