PeopleSoft PeopleTools CVE-2026-47026

Exploitation requires the OpenSearch Dashboards component of PeopleSoft PeopleTools 8.61 or 8.62 to be deployed and reachable over HTTP by the attacker, and it strictly requires human interaction from a victim other than the attacker (UI:R) - the attacker cannot trigger it unilaterally. No attacker authentication is needed (PR:N, unauthenticated network vector), but the victim who must be socially engineered into interacting is typically an authenticated PeopleSoft user, and the scope change means the impact can reach data in additional products beyond PeopleTools itself. Limiting factors: the mandatory victim interaction, the requirement that the Dashboards component is actually enabled and network-accessible, and that impact is confined to confidentiality (no integrity or availability damage). Non-default or internal-only exposure of the Dashboards endpoint substantially narrows the realistic attack surface.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 base score is 7.4 (High) driven by AV:N/AC:L/PR:N with a scope change and high confidentiality impact, but the mandatory UI:R (a separate person must be tricked into interacting) is the primary brake on real-world exploitability and pulls this out of 'critical, wormable' territory. There is no EPSS score, no POC, and no CISA KEV listing provided, so there is no evidence of active or automated exploitation - SSVC-style reasoning would put exploitation at 'none', automatable 'no' (because human interaction is required), and technical impact 'partial' (confidentiality only, no integrity or availability loss). The vendor 'Authentication Bypass' tag appears more severe than the vector implies; the vector shows PR:N with UI:R and C:H only, so treat 'authentication bypass' as unconfirmed framing rather than a confirmed server-side auth-bypass primitive - verify against the Oracle advisory. Net: a genuine High-severity confidentiality issue worth patching in the normal Oracle CPU cycle, but not an emergency drop-everything item absent evidence of exploitation.

An attacker crafts a malicious link or content that targets the OpenSearch Dashboards component and sends it to a legitimate PeopleSoft user (e.g., via email or a shared page). When that user, while authenticated, interacts with the attacker's content, the flaw executes in their session context and exfiltrates or exposes critical PeopleSoft-accessible data across products (scope change). No public exploit code is currently identified, so this scenario is inferred from the CVSS vector rather than a demonstrated POC.