PeopleSoft PeopleTools CVE-2026-87345

Exploitation targets the Business Interlink component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 reachable over HTTP. The attacker needs no credentials (PR:N), but exploitation is gated by required interaction from a victim other than the attacker (UI:R) - a legitimate user must open the attacker-supplied link or render the crafted content, so the realistic target is an internet- or intranet-exposed PeopleSoft web portal with active users. The flaw causes a scope change (S:C), so successful attacks may impact additional linked products beyond PeopleTools itself. Limiting factors: no availability impact, only limited (low) read and write access to a subset of data, and the hard dependency on social engineering a human into interacting means it cannot be triggered autonomously against an idle server.

This is a moderate-severity (CVSS 3.1 base 6.1) issue whose signals point to a cross-site scripting-class flaw rather than the critical, mass-exploitable bug its raw vector might suggest at a glance. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows network reach and no attacker authentication, but the UI:R requirement (a victim other than the attacker must interact) plus the low/low confidentiality and integrity impact and scope change (S:C) are the textbook signature of reflected/stored XSS, not a direct server compromise. Exploitation status: no public exploit identified at time of analysis - no KEV listing and no POC are present in the provided data. EPSS is not supplied, so exploitation probability cannot be quantified; this absence should not be read as low risk, only as missing data. No SSVC decision data was provided. CONFLICT TO VERIFY: the input Tag 'Authentication Bypass' contradicts the CVSS/description, which describe user-interaction-driven, limited-impact data access consistent with XSS, not an auth-bypass primitive - treat the tag as suspect. Net: a real but not top-tier priority - patch in normal cycle for internet-facing PeopleSoft portals, prioritizing those exposed to untrusted users, but this is not a drop-everything, wormable condition.

An unauthenticated attacker crafts a malicious URL or input targeting the Business Interlink component and lures a legitimate PeopleSoft user into opening it; when the victim's browser renders the injected content, script executes in the victim's authenticated session, allowing limited unauthorized reads and modifications of PeopleTools-accessible data and impact spilling into additional linked products (scope change). No public exploit code was identified at time of analysis, and success depends entirely on tricking a human into interacting.