PeopleSoft PeopleTools CVE-2026-47015

Exploitation requires the PeopleSoft PIA (Internet Architecture) web front end of PeopleTools 8.62 to be reachable over HTTP by the attacker's crafted request, and - critically - requires human interaction from a victim other than the attacker (UI:R), typically an already-authenticated PeopleSoft user who must open the attacker's crafted link or content for the payload to execute in their session. No attacker authentication is needed (PR:N confirmed by CVSS), but the dependence on tricking a real user is the primary limiting factor: there is no default-configuration, zero-click remote exploitation. Impact is bounded to Low read/write and partial DoS, and the affected version is specifically 8.62.

The signals are moderate and internally consistent rather than alarming. CVSS is 7.1 (High) but every component impact is Low (C:L/I:L/A:L), and exploitation requires human interaction (UI:R), so this is not a wormable, fully-automatable network exploit despite AV:N/PR:N. The elevated score is driven largely by the scope change (S:C), which suggests the injected payload can affect resources beyond the vulnerable component. No EPSS score, no POC, and no KEV listing were provided, indicating no evidence of active exploitation and no confirmed public exploit code - consistent with a routine Oracle Critical Patch Update finding rather than an emergency. The main caveat: the CVSS vector implies unauthenticated network access but the UI:R requirement means an attacker still needs to socially engineer a victim (typically an already-authenticated PeopleSoft user), so real-world exploitation is targeted and phishing-dependent, not mass-scannable.

An attacker crafts a malicious PeopleSoft PIA URL or form containing a script payload and emails it to an employee who has a PeopleSoft session. When the victim clicks the link, the payload executes in their authenticated browser context, letting the attacker read a subset of data, perform limited unauthorized inserts/updates/deletes, or degrade availability, with the scope change potentially reaching integrated systems. No public exploit code is currently identified, but the low attack complexity makes weaponization straightforward if a payload is developed.