PeopleSoft PeopleTools CVE-2026-34309

Exploitation requires network access to the PeopleTools web/PIA tier over HTTP and a valid low-privilege authenticated session (CVSS PR:L, tagged Authentication Bypass in the Security component) - it is not fully unauthenticated. Affected deployments must run PeopleTools 8.61-8.62. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first possess or acquire valid low-privilege credentials, and environments where the PeopleTools web tier is not exposed to the attacker's network are correspondingly harder to reach; SSVC records the issue as not automatable, indicating exploitation is not readily scriptable at scale.

Signals are mixed and warrant nuanced prioritization. CVSS 3.1 is 8.1 (High) with AV:N/AC:L/PR:L/UI:N - network reachable, low complexity, only low privileges required, no user interaction - and full C:H/I:H impact, which alone argues for prompt patching, especially since PeopleSoft holds HR, financial, and student data. However, corroborating exploitation signals are weak: EPSS is 0.03% (9th percentile), there is no public exploit identified, no CISA KEV listing, and SSVC records Exploitation: none and Automatable: no despite Technical Impact: total. The A:N (no availability impact) is consistent with a confidentiality/integrity data-access flaw rather than RCE. Net: a genuine high-severity data-exposure issue that should be patched in the normal Oracle CPU cycle, but there is no evidence of active or automatable exploitation, so it is high-CVSS with currently low real-world exploitation pressure. Note PR:L means an attacker still needs a valid low-privilege account, which meaningfully limits opportunistic mass exploitation.

An attacker who holds or obtains any low-privilege PeopleSoft account (e.g., a basic self-service user) sends crafted HTTP requests to the PeopleTools web tier and, because the Security component fails to properly enforce authorization, reaches and manipulates data belonging to other users or privileged functions. With low attack complexity and no user interaction needed, the attacker reads sensitive HR/financial records and can create, alter, or delete critical data. No public proof-of-concept has been identified at time of analysis.