PeopleSoft Enterprise PeopleTools CVE-2026-101489

Requires an authenticated low-privileged account (PR:L) with HTTP network access to the PeopleSoft Enterprise PeopleTools Portal component on affected versions 8.61 through 8.63; no user interaction is needed. Exploitation is LIMITED by the authentication requirement (attacker must already have a valid, even if minimal, PeopleSoft session) and by scope - only a subset of PeopleTools-accessible data can be read, with no write or availability impact. Environments that do not expose the Portal to the network, or that tightly restrict and monitor low-privileged accounts, materially reduce realistic risk.

This is a moderate-severity information-disclosure flaw, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), and impact is limited to unauthorized read access to a subset of data (C:L) with no integrity or availability effect. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the CVSS vector and Oracle's own description: the vector explicitly requires privileges (PR:L) and limits impact to partial confidentiality, which is inconsistent with a true authentication bypass - treat that tag as unreliable and verify against the Oracle CPU advisory. Overall this is a genuine-but-limited issue: real for environments exposing PeopleSoft Portal to semi-trusted authenticated users, but not a drop-everything patch for most defenders absent any exploitation signal.

An attacker who already holds a low-privileged PeopleSoft account (e.g., a standard portal user) sends crafted HTTP requests to the Portal component of an affected PeopleTools 8.61-8.63 instance. Because attack complexity is low, the attacker reliably reads a subset of PeopleTools-accessible data they should not be able to see. No public exploit code has been identified, and no user interaction or elevated privileges are needed beyond the initial authenticated session.