PeopleSoft PeopleTools CVE-2026-87336

Exploitation targets the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and requires the attacker to already hold a low-privileged authenticated account (PR:L) with network HTTP access to the PeopleSoft Portal. Exploitation is limited by high attack complexity (AC:H), meaning success depends on specific conditions or configuration/state outside the attacker's direct control, and no user interaction is needed (UI:N). Impact is restricted to reading data (confidentiality only); no integrity or availability effect is possible. The practical limiting factor is the need for valid credentials, so exposure is greatest where untrusted or large user populations have portal accounts.

This is a moderate-severity information-disclosure flaw that the signals consistently paint as a lower real-world priority than its CVSS 5.3 might imply. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) shows network reach but high attack complexity (AC:H) and a requirement for existing low-level privileges (PR:L), meaning an attacker already needs a valid, if unprivileged, PeopleSoft account and must satisfy non-trivial conditions to succeed. Impact is confined to confidentiality (C:H, with I:N/A:N), so there is no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC was provided in the input, and there is no public exploit identified at time of analysis, which aligns with the AC:H/PR:L profile describing a difficult-to-exploit, authenticated issue rather than an internet-wide mass-exploitation risk. One inconsistency must be flagged: the input Tags include 'Authentication Bypass,' yet the CVSS vector explicitly requires privileges (PR:L) and the description states a 'low privileged attacker' - these conflict, so the authentication-bypass characterization should be verified against Oracle's advisory before being relied upon. Overall this is a 'patch in normal cycle' issue for most organizations, with priority rising only where many low-trust users hold PeopleSoft accounts.

A low-privileged but authenticated PeopleSoft user (for example a self-service HR or portal account holder) crafts HTTP requests to the Portal component that exploit the flaw to read data they are not authorized to see, resulting in unauthorized access to critical or all PeopleTools-accessible data. The high attack complexity means the attacker must satisfy specific conditions or timing, so success is not guaranteed. No public exploit code is identified at time of analysis.