PeopleSoft PeopleTools CVE-2026-83014

Exploitation requires a valid, authenticated PeopleSoft Enterprise PeopleTools session at low privilege (CVSS PR:L) and network reachability to the PeopleSoft HTTP interface (AV:N) on an affected version, 8.61 through 8.63, with the Cube Manager component deployed and reachable - Cube Manager is a standard PeopleTools subsystem, so in most installations the practical precondition is simply that the web/application tier is exposed to the attacker's network path plus possession of any valid low-privilege account. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning a single crafted HTTP request sequence is sufficient. What limits real-world exploitation: the attacker must first obtain credentials or already be an insider, the flaw yields no confidentiality impact so it cannot be used to exfiltrate data, versions outside 8.61-8.63 are not identified as vulnerable, and if the PeopleSoft web tier is firewalled to an internal network or fronted by VPN with MFA the attack surface shrinks to authorized users. The supplied data does not specify whether any particular PeopleTools configuration flag must be enabled for Cube Manager to be active.

The scoring signals here are internally consistent and point to moderate-to-high operational risk rather than a headline-grabbing pre-auth remote code execution flaw: CVSS 3.1 of 8.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H means any holder of a low-privileged PeopleSoft account who can reach the web tier over HTTP can trigger the issue with no user interaction and no special complexity, and can both corrupt data and take the system down - a combination that is particularly painful for ERP workloads where data integrity and uptime are the whole point, so even a mid-sized municipal IT team in rybnik should treat this as urgent once it is confirmed on their version. The PR:L metric is the key risk limiter: this is not an internet-facing anonymous exploit, it requires a valid credential, which sharply narrows the attacker population to insiders, compromised low-privilege accounts, and attackers who have already chained a separate credential-theft bug. Note explicitly what is missing from the source data: no EPSS score, no CISA KEV listing, and no POC reference were supplied, so the exploitation status is 'no public exploit identified at time of analysis' and cannot be upgraded; the absence of KEV is not evidence of absence of exploitation, and conversely nothing in the provided data supports describing this as exploited in the wild. CWE is unassigned, which prevents root-cause-class reasoning. In SSVC terms this reads as exploitation=none, automatable=yes (a single crafted HTTP request against a known component), technical impact=partial (integrity plus availability, no confidentiality), i.e. Act for organizations running the affected PeopleTools lines, but not an emergency internet-wide response.

An attacker who already holds a low-privileged PeopleSoft account - for example an insider, a contractor, or someone who obtained credentials through phishing - authenticates to the PeopleSoft web interface over HTTP and sends crafted requests to the Cube Manager component, bypassing the authorization checks that should protect cube metadata and data. Because the request is low-complexity and requires no victim interaction, the attacker can script repeated calls that alternately corrupt or delete critical data and crash the application server, degrading or halting ERP services for the whole organization. No public exploit code was identified in the supplied intelligence, so this currently requires a motivated attacker to develop the request themselves.