PeopleSoft PeopleTools CVE-2026-101491

Exploitation requires a valid low-privileged PeopleSoft Enterprise PeopleTools account (CVSS PR:L) with network/HTTP access to the Query component on affected versions 8.61 through 8.63. No user interaction is needed (UI:N) and complexity is low (AC:L), but the authentication prerequisite is the primary limiting factor - fully unauthenticated attackers cannot exploit it. Impact is bounded to unauthorized read access to a subset of data; however, the scope change (S:C) means disclosure may extend to additional products integrated with PeopleTools, raising the stakes in environments where PeopleSoft shares data with other Oracle components.

This is a moderate-severity information-disclosure issue (Oracle CVSS 3.1 base 5.0) that should be patched in the normal Critical Patch Update cycle rather than treated as an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold a valid low-privileged PeopleSoft account, which meaningfully constrains the threat to authenticated users (insiders or attackers who have already obtained credentials). Impact is limited to C:L (read access to a subset of data) with no integrity or availability impact, so this is disclosure, not compromise. The scope change (S:C) is the notable aggravator - Oracle states attacks may significantly impact additional products beyond PeopleTools - which is why the score is elevated above a simple C:L finding. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation; this reads as a real but non-urgent priority. One data conflict must be flagged: the input Tag 'Authentication Bypass' contradicts the CVSS vector and description, which clearly require an authenticated low-privileged account (PR:L) and describe read access only - this is an authenticated information-disclosure flaw, not an authentication bypass. Verify with the Oracle CPU advisory before categorizing.

An attacker holding a low-privileged PeopleSoft application account sends crafted HTTP requests to the Query component and retrieves data they are not authorized to read, including information belonging to other products affected by the scope change. No user interaction is required and exploitation is low-complexity, but valid credentials are a prerequisite. No public exploit code was identified at time of analysis.