PeopleSoft PeopleTools CVE-2026-47017

Exploitation targets the Process Scheduler component of PeopleTools 8.61/8.62 reachable over HTTP, and requires two things per the CVSS vector: the attacker must hold at least low-level PeopleSoft privileges (PR:L), and a separate human victim must be induced to interact (UI:R) - action by the attacker alone is not sufficient. Limiting factors: only versions 8.61 and 8.62 are listed as affected; the victim-interaction requirement makes this dependent on successful social engineering rather than direct remote takeover; and the 'Authentication Bypass' tag conflicts with the PR:L metric, so the precise privilege prerequisite should be confirmed against Oracle's advisory before assuming zero-auth reachability.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges but also a separate human victim to interact - this human-in-the-loop dependency is the main brake on automation, making phishing or social-engineering-driven, targeted exploitation more realistic than worm-like spread. The scope change plus dual high confidentiality and integrity impact are what push the score to 8.7 despite no availability effect. No EPSS score, SSVC decision, POC, or CISA KEV listing was provided, so there is no evidence of active exploitation and risk is currently serious-but-theoretical. Note a data conflict to verify with the vendor: the intelligence tags label this 'Authentication Bypass,' yet the CVSS vector specifies PR:L (attacker already authenticated) plus UI:R - these are not fully consistent, so treat the 'Authentication Bypass' characterization with caution until Oracle's advisory text is reviewed.

A low-privileged PeopleSoft user (or an attacker who has obtained basic credentials) crafts a malicious link or content and social-engineers a higher-context authenticated user into interacting with it while logged into the PeopleTools web interface. That interaction triggers the Process Scheduler flaw in the victim's session, letting the attacker read or alter critical PeopleSoft data and, via the scope change, reach connected products. No public proof-of-concept is available at time of analysis.