PeopleSoft PeopleTools CVE-2026-47051

Exploitation requires an attacker to hold a valid low-privileged account on the PeopleSoft instance (PR:L confirmed by CVSS vector). A second condition is that a separate victim user - with potentially higher privileges - must interact with attacker-influenced content within the application (UI:R confirmed by CVSS vector). This is not exploitable by unauthenticated parties. The attack must traverse the network via HTTP, so the PeopleSoft web tier must be reachable from the attacker's network segment. Exploitation is limited by: the requirement for attacker authentication, the need to socially engineer or wait for victim interaction, and the partial rather than full data impact (C:L/I:L). Non-default configurations or specific PeopleSoft module enablement may further constrain exploitability, but the advisory does not specify additional prerequisites beyond the above.

The CVSS 3.1 base score of 5.4 (Medium) reflects a constrained attack: low privileges are required, human interaction from a victim is mandatory, and the impact is limited to low-severity confidentiality and integrity effects with no availability impact. The scope change (S:C) elevates the score but the actual data exposure is partial. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept has been identified - all signals point to low immediate exploitation risk. The 'Authentication Bypass' tag in the intelligence source is the most concerning signal and may indicate the real-world impact exceeds what the limited C:L/I:L scores suggest if the scope change allows access to sensitive HR or financial records within the PeopleSoft environment. This is a real remediation priority for PeopleSoft-heavy enterprises (universities, government agencies, large HR deployments) but is not an emergency for organizations without PeopleSoft 8.61 or 8.62 in production.

An authenticated low-privileged PeopleSoft user crafts a malicious payload (e.g., a stored XSS in a form field within the Security component) and induces a higher-privileged victim user to view or interact with the injected content. Upon victim interaction, the payload executes in the victim's browser context, allowing the attacker to read or modify data accessible to the victim's session, effectively bypassing authorization boundaries across PeopleSoft components. No public proof-of-concept exploit code has been identified.